How would this be automated in the worklow? about recovery

[antonioribeiro]

I store them in the database, encrypted, in the users table, using a json column (backup_codes). Storing 8 codes would take around 200 chars, I don't thing this is too big.

There's this issue which goes a little in the workflow: antonioribeiro/google2fa#85 (comment)

I think it's pretty straightforward:

Register or Logged in
User asks to enable 2FA
Show 2FA qr-code
Show 2FA backup codes
Test the 2FA qr-code
Test one 2FA backup-code
System enables 2FA

Login
Ask for login/password
Ask for 2FA
User cannot give a right code?
Ask for a backup code.

[nickurt]

Yeah, same request here aswell, what is the best workflow/example in an application for this?

[nickurt]

Thank you!, I understand the workflow now! 👍

[diadal]

how can I test this Test one 2FA backup-code is it auto accepted by 2fa or I need to create different method to test

[colinwilson]

I store them in the database, encrypted, in the users table, using a json column (backup_codes)

@antonioribeiro could you expand (code wise) on how you store them encrypted? I'm currently troubleshooting storing the generated codes encrypted in a PostgreSQL json column myself (Laravel 5.6).

[foresighthub]

Hi,

I know this is an old thread but I have a question.

If a user uses one of the backup codes, is it best practice to delete that code from the list of backup codes and add another unique one? Or if a backup code is used it should be marked as invalid from then on.