| Reedy | |
| Sep 29 2025, 8:05 AM |
| F66713198: CleanShot 2025-09-30 at 12.35.40.png | |
| Sep 30 2025, 10:36 AM |
At the moment, with the patch for T232336: Separate recovery codes into a separate 2FA module, they just magically disappear in the background.
If we don't want users to have recovery codes without any other 2FA, we should note that they're being deleted on the confirmation screen(s).
If we don't want users to have recovery codes without any other 2FA, we should note that they're being deleted on the confirmation screen(s).
that is correct, the proposal is to not use recovery codes as a stand-alone 2FA method. in this task T404268: Warn users before they delete their last 2FA key we're revising the copy to warn users about disabling 2FA entirely if they remove their last 2FA method (see my last comment).
Obviously it's fine that we don't want to allow (only) recovery codes.
I still think we should do something explicitly for this messaging, as otherwise they're being deleted when it wasn't made very clear that they're dependant.
i see, gotcha! so, we should find a way in the current language that discloses the dependency, here's a quick exploration... this screen is for when the user tries to remove their last active 2FA method
Change #1199501 had a related patch set uploaded (by Mstyles; author: Mstyles):
[mediawiki/extensions/OATHAuth@master] Explicit warning for recovery codes
Change #1199501 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Explicit warning for recovery codes
Change #1199718 had a related patch set uploaded (by Reedy; author: Mstyles):
[mediawiki/extensions/OATHAuth@REL1_45] Explicit warning for recovery codes
Change #1199718 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@REL1_45] Explicit warning for recovery codes