Support » Plugin: Two Factor Authentication » One Time Passwords Don't Match

  • Resolved Greyleg

    (@odeskumair)


    Hi,

    The one time passwords shown in the plugin settings page is not the same as in my phone.

    I’ve checked the server time and my phone time and they are the same.
    Tried deleting and adding TFA account from Authy and Free OTP Andriod app but the same problem. Also, changed Private Key

    Tried deactivation/activating pluign.

    The problem remains.

    Any idea what is wrong?

    https://wordpress.org/plugins/two-factor-authentication/

Viewing 10 replies - 1 through 10 (of 10 total)
  • Plugin Author David Anderson

    (@davidanderson)

    Hi,

    Have you refreshed the code shown on the settings page so that it shows the current one (by pressing the ‘refresh’ link)? Otherwise, it shows the one from the time the page loaded, which may have expired. How are you entering the private key into your app? If you’re scanning a QR code, then try entering it as text; or vice-versa.

    David

    Thread Starter Greyleg

    (@odeskumair)

    Yes, I know that the setting page OTC needs to be refresh to see the current code.

    Yes, did it with the scanning QR code and by copy pasting the private key in Authy App.

    Any other ideas what might have gone wrong?

    Plugin Author David Anderson

    (@davidanderson)

    Hi,

    Given a private key, the TOTP algorithm produces codes based exclusively upon that private key and the current time (which is how an external device can produce a code given just the private key – because it already knows the time). So, if the key has been entered directly and correctly, then the only other possibility is that the server and device don’t agree upon the time.

    David

    Plugin Author David Anderson

    (@davidanderson)

    P.S. If you’d like me to take a look directly, then you can send your WP login credentials here: https://www.simbahosting.co.uk/s3/contact/ – but don’t post them in this public forum.

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    *Raises coffee mug*

    Side note: @davidanderson You know I love your plugins, think highly of you, etc. Warm thoughts all around.

    But please do not make a request for login credentials. Ever. It’s going to far and is actively discouraged. Yes, any 2 Factor Authentication (yours is on my list to test [it’s a never ending long list BTW]) is complicated but there are so many other ways to help people here in these forums.

    I know you mean the best but please keep support in these forums.

    Empties coffee mug, wishes for more

    Plugin Author David Anderson

    (@davidanderson)

    Hi Jan,

    OK – no problem! I had been thinking of “actively discouraged” in terms of “last resort”, rather than “never ever do it”. Understood now.

    Greyleg: You’ll have to do something like posting a screenshot of what the TFA plugin dashboard claims your server time is, next to what your phone says, or something of that sort.

    David

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    *Successfully gets coffee, thanks David for understanding.* 😉

    Was this resolved, could it be related to daylight savings time change?

    Plugin Author David Anderson

    (@davidanderson)

    could it be related to daylight savings time change?

    No; the TOTP protocol is not based upon local time zones – https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm#Definition .

    Given a private key, the TOTP algorithm produces codes based exclusively upon that private key and the current time (which is how an external device can produce a code given just the private key – because it already knows the time). So, if the private key has been entered directly and correctly, then the only other possibility is that the server and device don’t agree upon the time.

    David

    Thread Starter Greyleg

    (@odeskumair)

    Apologies for responding this late. Turned on the plugin today and things are magically working again. So, it is resolved.

Viewing 10 replies - 1 through 10 (of 10 total)
  • The topic ‘One Time Passwords Don't Match’ is closed to new replies.