Users deleting 2fa without removing backup keys #28

Activity

1. paul999 commented on Sep 20, 2020

   

   paul999

   on Sep 20, 2020

   Owner

   More actions

   Hmm, I am not fully sure what the best way to solve is. Technically, it is a perfect valid situation to just have backup keys, so I don't want to really force it to have them deleted. But I can see how it might be causing issues. I will need to think a bit more about this
2. Aminuxer commented on May 5, 2022

   

   Aminuxer

   on May 5, 2022

   More actions

   Static backup keys for users without main 2FA secrets can be found by this SQL query:

   SELECT t1.*
   FROM `phpbb_tfa_back_reg` t1
   WHERE t1.user_id NOT IN
        (SELECT DISTINCT t2.user_id FROM phpbb_tfa_otp_reg t2)
   
3. Neustradamus commented on Jun 14, 2026

   

   Neustradamus

   on Jun 14, 2026

   More actions

   @paul999: Have you thought about this?
4. MaxHayman commented on Jun 14, 2026

   

   MaxHayman

   on Jun 14, 2026

   Author

   More actions

   Would be nice to have an option to "remove backup keys when OTP is removed"