| Catrope | |
| Sep 10 2025, 10:01 PM |
| F66713028: image.png | |
| Sep 30 2025, 9:16 AM |
| F66026304: image.png | |
| Sep 16 2025, 6:14 PM |
| F66026299: image.png | |
| Sep 16 2025, 6:12 PM |
| F66023358: image.png | |
| Sep 15 2025, 11:09 AM |
Once T401774: Redesign UI for listing 2FA methods and adding new methods is done, users will be able to delete individual 2FA methods directly from Special:AccountSecurity. When a user tries to delete a key, they already have to click through a warning explaining that they won't be able to use that key anymore.
However, when a user tries to delete their only remaining 2FA key, we should display a different or additional warning explaining that they're turning off 2FA completely.
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| Add warning for privileged users | Mstyles | mediawiki/extensions/OATHAuth | master | +31 -6 | |
| Warn users before deleting last 2FA key | Mstyles | mediawiki/extensions/OATHAuth | master | +96 -32 |
Note after T232336: Separate recovery codes into a separate 2FA module recovery codes will become a dedicated 2FA module, but user should never have it as the only 2FA method.
@Catrope if the 2FA method is the only (and last) one we could consider displaying a warning message inside the confirmation dialog. with this approach the current ux copy remains as is (no matter if you are trying to delete the only/last method, or if it's one of many) while the warning message takes care of explaining that proceeding with the action will disable 2FA completely.
here's an example. ux copy still in progress, so take it with a grain of salt
@Mstyles i've updated the ux copy in our document (internal google doc). here's also a summary of the different flows based on the number of 2FA method and/or user special rights:
Change #1193504 had a related patch set uploaded (by Mstyles; author: Mstyles):
[mediawiki/extensions/OATHAuth@master] Warn users before deleting last 2FA key
Change #1193504 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Warn users before deleting last 2FA key
With a special case for privileged users (OATHRequiredForGroups):
This part still needs to be implemented. To be done in a second patch
Change #1199043 had a related patch set uploaded (by Mstyles; author: Mstyles):
[mediawiki/extensions/OATHAuth@master] Add warning for privileged users
Change #1199043 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Add warning for privileged users
