Please don't post about US Politics. If you need to do this, try !politicaldiscussion
1) Be nice and; have fun
Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them
2) All posts must end with a '?'
This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?
3) No spam
Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.
4) NSFW is okay, within reason
Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com.
NSFW comments should be restricted to posts tagged [NSFW].
5) This is not a support community.
It is not a place for 'how do I?', type questions.
If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.
Reminder: The terms of service apply here too.
Logo design credit goes to: tubbadu
I did the same thing on a different Lemmy instance, probably for the same reason. I just created a pull request to fix the broken instructions - pull 88.
Nothing is lost, but I'm quite sure that the instance admin will need to disable 2FA in your account for you to regain access, however I suspect that the lemmy.world admin is going to be busy for a while due to the recent exploit.
My guess is admins should be able to fix it
Ah that sucks, was just talking about Lemmy's incomplete 2FA in a different post https://lemmy.world/post/1288267
You're right, unlike most websites/apps using 2FA Lemmy does not display a QR code.
You probably need to contact the admins for your Lemmy instance & see what they can do. (lemmy.world in your case)
FWIW I found the string for 2FA if you right click open link in New window. Then you can read the string to import into an authenticator app from there. Had it generating codes but the codes wouldn't let me login on my app so I disabled for now. Hope they can fix this in the future.
if you used an email to register you can still recover your account
this worked, wasn't working last night, but worked just now was able to log in after resetting password, so to settings, and remove 2FA, thanks
This worked for me. The password reset link will log you in, and you can then disable 2FA and try again.
This helped me, thanks!
Same thing happened to me. The link didn’t appear on mobile. After a password reset on a desktop browser, the 2fa link appeared.
I tried to enable it and it didn't work... Luckily, I'm not locked out and was able to disable it.
for some reason, which has to be fixed soon because it’s a huge security risk, you can log back into your account without 2fa after resetting your password via email
nvm, didn’t read the 2nd sentence lmao
Always worth - whenever you change authentication settings - opening a new incognito tab and try signing in.
If it fails, hopefully your actual tab is still authenticated so you can disable/edit
tbh I'd be concerned that the devs would even think of pushing this kind of unfinished and broken feature to a live build
This happened to me on my beehaw account when they first announced 2FA. The accounts are now gone for us. Just saw the edit... going to see if that works for me. I might be hosed though because I'm not sure I entered an email.
I thought 2fa wasn't working correctly yet in 0.18.1
Can you elaborate? I've got it enabled and working on my personal instance running 0.18.1. Is there an authentication check that isn't actually happening in the login flow or something?
FYI if this is because of the cross-site attack on Lemmy.world you should know 2FA will NOT help as the attacker accesses the JWT key directly which has already been signed in w/2FA. The only way to mitigate it is to use a native app and not the web or PWA version.
