jcs / rubywarden

An unofficial, mostly Bitwarden-compatible API server written in Ruby (Sinatra and ActiveRecord)
ISC License
593 stars 49 forks source link

Implement 2FA recovery code #110

Closed mk-f closed 2 years ago

mk-f commented 4 years ago

Bitwarden offers to use a recovery code in case of losing the second factor.

For now it seems possible to deactivate 2FA for an account by manually resetting the totp_secret of the respective user:

update users set totp_secret = null where email = 'some@user.tld'