Current it asks for your 2fa before it even know if you have one!
However, we should split this into a different page or a magic live view page so users aren't confused. The 90% of our users will probably not have 2FA enabled for awhile.
We also need to ensure once we add this that we do not confirm the users account exists (by showing 2fa), unless the password is correct.
clone1018
commented
4 years ago
Current it asks for your 2fa before it even know if you have one!
However, we should split this into a different page or a magic live view page so users aren't confused. The 90% of our users will probably not have 2FA enabled for awhile.
We also need to ensure once we add this that we do not confirm the users account exists (by showing 2fa), unless the password is correct.