search

twofas / 2fas-browser-extension

Source code for 2FAS Browser Extension
https://2fas.com/browser-extension
GNU General Public License v3.0
270 stars 36 forks source link

Wrong code sent to browser extension when there is more than one account #4

Closed user2663723 closed 1 year ago

user2663723 commented 1 year ago

If I have multiple accounts for a specific website and I use the browser extension, the first time I log in, the extension will ask me which token to send. However, after that initial login, the extension will continue to use the same token without asking, even if I have multiple accounts on that website and inside 2FAS.

For example, let's say I have account 1 and account 2 on website abc.com. The first time I want to log in to account 1 and I use the browser extension, the extension will ask me which token to use. I select account 1 and the correct code is sent to the browser. But if I then log out and want to log in to account 2, the extension will send the request to the app again, but this time the app will think it should send the code for account 1 because that was what was chosen last time.

It would be helpful to have an option in the settings that lets us disable the extension from remembering which code was sent and ask for confirmation every time. Alternatively, the extension could be designed to recognize when there are multiple accounts for the same website and always ask which account token to use.

2fas-com commented 1 year ago

We are aware of the problem and are fixing it right now, but thank you for your feedback.

noxe-svsoftware commented 1 year ago

I have the same problem. Whenever I want to use the extension, for example to log in to PayPal, the PIN of the Tesla token is taken. It can't be that this hasn't been fixed yet.

What it currently looks like to me is that you can only use a maximum of one token in the 2FAs app, which makes it pointless.

I also looked for setting options, but didn't find any. I can't even remove or delete the token I specified when using it for the first time (Tesla in my case). It can't be that no one noticed.