Broken in 4.6 about two-factor HOT 14 CLOSED

Do all of the other methods work?

from two-factor.

Do we have anyone else who can also test with a Yubikey?

from two-factor.

Tested with a Yubikey NEO.
Works on one domain updated to 4.6.1 but unable to add keys to new users.
Fresh install on another domain installed as 4.6.1 fails every time. Briefly displays a message asking you to use your key then shows Failed.

Both wordpress installs test http and https.

Edit:
Google Auth works fine.

from two-factor.

Can confirm on 4.6.1 I can't add a Yubico Fido U2F key. Pressing the "Add new" button results in a "Failed" message and nothing seems to light up on the dongle itself. OTP seems to work fine with Goog authenticator

MacOS Sierra / Chrome 54.0.2840.59 (64-bit)

from two-factor.

@georgestephanis Here is the error message from the console when trying to register a new Yubikey:

I'm looking into this now.

from two-factor.

@JSkier21 @meltedprocessor @GreenTentacle

Was your website recently upgraded to use HTTPS? If so, the U2F AppID probably changed from http://example.com to https://example.com and you need to re-register the security keys.

Are there any error/debug messages in the browser console when adding the security key or during the login? Something like:

Is this the first time you're adding the key to the website (The U2F JS library will return an error if the same security key is being registered twice)? Try removing all existing keys from your profile and adding them again.

from two-factor.

AppID has been a problem on current domain (was waiting for Let's Encrypt - Took a while) but one domain tested has had a StartCOM SSL Cert installed for a long while.
Removed plugin - Updated addresses in wordpress settings - Added plugin and tested working fine.

Had to add the key then go back into user settings and enable U2F for it to work (didn't like doing both at the same time).

I am seeing in the below in the console every time wp-login.php is loaded although it's not causing anu problems.

Many thanks for the update!

from two-factor.

Updated to the newest plugin update and made sure site address and wordpress address were set to https:// instead (woops). Still can't add a Fido token for another user (which sort of makes sense when i think about it, but maybe should warn ?), but logging in as that user and adding the token works fine.

from two-factor.

@meltedprocessor @GreenTentacle The funny thing is that the latest update didn't include any code changes -- it was triggered automatically for some reason.

@meltedprocessor That JS error on the username/password login page is a known issue #126.

@GreenTentacle Adding security tokens to other users currently isn't possible because it always references the current user here. Here is the issue #127.

I'm closing this because it works correctly over HTTPS with a fresh install.

from two-factor.

Sorry for not getting back on this. Anyway, I see it's closed. Tried removing and then adding keys but could not. I'll remove and try installing plugin again.

from two-factor.

u2fL10n not defined now. Won't add new keys. I'll just use Google Auth.

from two-factor.

u2fL10n not defined now.

@JSkier21 Which page is that? Can you check the browser console output?

from two-factor.

On the profile page. Just upgraded to latest version, still an issue.

Below is the output you asked for.

load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.6.1:11 Uncaught ReferenceError: _zxcvbnSettings is not defined at a (load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.6.1:11) a @ load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.6.1:11 fido-u2f-admin.js?ver=0.1.0-dev.1:14 Uncaught ReferenceError: u2fL10n is not defined at HTMLButtonElement.<anonymous> (fido-u2f-admin.js?ver=0.1.0-dev.1:14) at HTMLButtonElement.dispatch (load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.6.1:3) at HTMLButtonElement.r.handle (load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.6.1:3)

from two-factor.

EDIT:
Security policy was to blame for this not working. Fully functional now.

Not sure that it matters, but which version should I use? Github or WP hosted?

Output from GitHub plugin on profile page trying to add a key:
Uncaught ReferenceError: u2fL10n is not defined at HTMLButtonElement.<anonymous> (fido-u2f-admin.js?ver=0.1.0-dev.1:14) at HTMLButtonElement.dispatch (load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.7:3) at HTMLButtonElement.r.handle (load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.7:3) (anonymous) @ fido-u2f-admin.js?ver=0.1.0-dev.1:14 dispatch @ load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.7:3 r.handle @ load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=4.7:3

from two-factor.