Two-factor authentication and GLBSE

[copumpkin]

I signed up for GLBSE a couple of days ago to buy some of amazingrando's bitbonds and have decided to withdraw some of the coins I have in my account. I was surprised to see that the withdrawal page wanted a two-factor auth token, since I don't remember ever setting one up. My settings page seems to have ambiguous wording about setting up two-factor auth, but there's nothing clickable on it: http://snapplr.com/febd

I went through the signup process again as a different user and indeed, it does give me four checkboxes for choosing what features I would like to use two-factor auth for, but then it never gives me a secret key or any indication of how to work the two-factor auth. Most sites I use Google authenticator with give me a 2d barcode to scan and I've never had any trouble with them. Am I missing some crucial detail? Or is the two-factor stuff not ready yet? In which case, perhaps it'd be better to disable the four checkboxes during signup, so that people like me aren't stuck unable to do anything with their accounts.

Has anyone figured this out? Maybe I'm just being stupid here

[Stephen Gornick]

If I read this correctly, that was a problem and has been corrected.  Contact nefario to help get two-factor removed:
 - http://bitcointalk.org/index.php?topic=73910.msg840646#msg840646

[copumpkin]

Nope, hasn't been corrected. I just tried creating another two new accounts and I get four checkboxes to use two-factor auth on specific features. Checking all of them, I still get sent straight to my account page after clicking sign up, with no QR code. At that point, I'm stuck with an account that thinks I have two-factor auth turned on, but I was never given the secret key.

Blitzboom has also verified this independently on IRC. Apparently, if you don't turn on the two-factor auth checkboxes during signup and turn them on in the settings page, the QR code is displayed correctly and all is well.

[N12]

I just tried it out together with copumpkin, and indeed during signup it will not show the codes if you select any of the checkboxes for 2-factor auth. Then, when you go to settings, it will assume you have 2-factor set up already and you are locked. If you just do it via settings, it will work fine, though.

The solution is probably to reset the settings from people who have signed up recently and are affected by this (and of course to fix the bug).

[marked]

developers meet dev.glbse.com, dev.glbse.com meet developers.

Test the damn software, test using use cases, test using the people who will actually help make it better.

Provided you listen to them of course.

marked

[mila]

did you enable (set up) 2step auth first on the gmail account?

[copumpkin]

did you enable (set up) 2step auth first on the gmail account?

What gmail account? As far as glbse is concerned, I have no gmail account.

What should happen:

• Request two-factor authentication
• Get a secret code in the form of a QR code to use with google authenticator
• Have glbse reject any actions from someone without the two-factor token
• 
• Profit!!

But we're missing a step:

• Request two-factor authentication
• Get a secret code in the form of a QR code to use with google authenticator
• Have glbse reject any actions from the user without the two-factor token
• 
• Piss off your users!!

[mila]

@compukin and how do you think the  2step authenticator from google apps will work?
which ID will be used to compute the floating code in the application?
where the fuck should glbse know the values for the 2nd step?
U NO follow the instructions?

here is what I did and how it worked
00 create a gmail accout
01 in google account settings go to settings and enable 2 step authentication
10 download the google authenticator in my smart phone
11 register a new user at glbse with that google email
100 enabled 2 step authentication and got the QR code displayed instantly (along the txt code) - simply scanned with the phone
101 profit

on another account I did skip the step 01 and it turned wrong there ...

edit sorry for being cocky to you

[Nefario]

Wooops, forgot to take the 2factor auth part off the signup form.

The general idea being that two factor auth is only enabled from settings, stopping people from turning it on without knowing what they are doing.

Everyone who has had it enabled and was not able to get their 2factor auth code please send an email to support@glbse.com using the email address you signed up with.

copumpkin, if you have any issues with GLBSE you need to contact support@glbse.com first.

The support address is there to help you out and solve any issues you have.

Nefario.

[copumpkin]

Wooops, forgot to take the 2factor auth part off the signup form.

The general idea being that two factor auth is only enabled from settings, stopping people from turning it on without knowing what they are doing.

Everyone who has had it enabled and was not able to get their 2factor auth code please send an email to support@glbse.com using the email address you signed up with.

copumpkin, if you have any issues with GLBSE you need to contact support@glbse.com first.

The support address is there to help you out and solve any issues you have.

Nefario.

I do know what I'm doing. The signup form simply does not give us a QR code when signing up. And I did send support@glbse.com an email before posting here

Edit: sorry for sounding snarky. I just interpreted "stopping people from turning it on without knowing what they are doing" as suggesting that it's a user error rather than a site bug.

[copumpkin]

11 register a new user at glbse with that google email
100 enabled 2 step authentication and got the QR code displayed instantly (along the txt code) - simply scanned with the phone

The difference is not that you used gmail; it's that you first signed up, then turned on two-factor auth once you were registered. Gmail had nothing to do with it. Anyway, I know how this shit is supposed to work, and it wasn't working as intended

[Nefario]

Without sending an email to support@glbse.com , using the email address you signed up with we are unable to know which account is having the problem and therefor unable to do anything about it.

Please see this announcement we made on the forum on how to get support for GLBSE

Nefario.

[copumpkin]

All resolved, thanks! I even have two-factor auth working now

[splatster]

It would be nice to have 2 factor auth even for just logging in.

[Nefario]

It would be nice to have 2 factor auth even for just logging in.

Really?

[splatster]

It would be nice to have 2 factor auth even for just logging in.

Really?

Umm, yes.
Pulling out my phone and typing 6 digits is well worth the security.

[Nefario]

It would be nice to have 2 factor auth even for just logging in.

Really?

Umm, yes.
Pulling out my phone and typing 6 digits is well worth the security.

Sure, I'll add this to the next update.

[brunozisterer]

GLBSE should write on the button: Two Factor Auth is at the moment - on or off
And than they should explain thier customers what happens when they enable the two-factor authentication.

[Nefario]

2factor auth is now available for logins.

For those who don't have a smartphone (or are too lazy to use theirs) here is a simple ruby script that does the same.

http://pastie.org/3923747

Install ruby
then

Code:

gem install rotp

save the text to a file (in this case lets say 2fact.rb)
execute

Code:

./2fact.rb

Should spit out the correct code.

You probably want to do this in Linux (I don't really know how to do it in windows), and you need to have your systems time very accurate.

[unclescrooge]

Am I the only one to have trouble connecting with 2-factor auth?

I always get the same error "Auth code incorrect", while solving capcha.

yesterday I did a this issue once, but after a second try I managed to login. Today I can't login at all.