When 2fa is required you can't change your authenticator app without setting up something else first

[wolfsage]

Summary

If your organization requires 2FA and you only have a single authenticator app configured, and you need to switch authenticator apps, you can't update the existing one to be the new one. Instead you have to add some other 2fa first, then delete the authenticator app, then add a new authenticator app, then delete the other 2fa you've configured (if you don't want it).

Motivation

People who use google authenticator and switch to a new iphone have to reregister their authenticator apps with everything. This would make that easier.

[BYK]

@wolfsage not sure what your proposal is, can you elaborate? From what I'm understanding, if 2FA is required, then at no point in time you should be able to login without 2FA. Which means you need to add a new app before removing the old one. Am I missing something?

[wolfsage]

Let's imagine I'm using Sentry on an org that requires 2FA for all users.

I only use google authenticator app (TOTP).

I get a new phone, and therefor a new google authenticator app, and need to change my 2FA configured in sentry.

My steps right now are:

• Add some secondary 2FA like mobile or U2F (which requires multiple steps, each)
• Delete the totp 2FA
• Add the new totp 2FA
• Delete the mobile/U2F 2FA

That's a lot of steps.

I've used many other websites where I can just modify the TOTP to either generate a new secret or show me a QR code for the existing secret to migrate it to a new app. This is way more user friendly.

[BYK]

@wolfsage ah, now I get it. Thanks for taking the time to walk me through. I'll share this with the rest of the team and see what we can do to improve this flow.

[github-actions]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Accepted, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[wolfsage]

Bump, I guess? Unhelpful github-actions!

[InternetJohnny]

I'm running into this exact issue right now. However, for some reason when trying to do the whole workaround (add sms 2FA, delete TOTP 2FA, add new TOTP 2FA, delete sms 2FA), I can even get through the first step, because i never receive the sms. I am entering my country's phone code extension (+xxx). So now I cant even port my TOTP to new device

[localpcguy]

Not 100% sure if this is the same issue or not, but I'm not able to change my TOTP app, the page at https://sentry.io/settings/account/security/mfa/totp/enroll/ will show me a new QR code and secret key, but when I enter the token (which I presume from the other text is the new 6 digit one time password) from that key, it just refreshes and shows a new QR code and secret key. I've also tried using the previous OTP thinking maybe it was a security measure and would prompt for the new one (or force a new login) on a follow-up screen, with the same results. Either way, the new secret key is never saved and my original OTP continue to work, and this seems problematic as there are a number of situations where it would need to be able to be replaced/cycled. In this case, I just prefer to cycle the code whenever I switch apps rather than transfer the existing key, but in a security situation where the key had been compromised, this is really bad.