Support 2FA?

[frioux]

I'm pretty sure this doesn't support 2FA, so I can't use it.

[MestreLion]

What do you mean by 2FA? It does support the authentication code sent through email, just enter the code using --code. It also supports "importing" the authentication cookie from an authenticated browser session.

[frioux]

I mean the authy based 2FA; uses an app on your phone or an sms. I'll try
the cookie thing though; I'd expect that to work.

sent from a rotary phone, pardon my brevity
On May 2, 2016 8:02 AM, "Rodrigo Silva" [email protected] wrote:

What do you mean by 2FA? It does support the authentication code sent
through email, just enter the code using --code. It also supports
"importing" the authentication cookie from an authenticated browser session.

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub
#10 (comment)

[MestreLion]

I suppose it could support it. How exactly does it work? If the browser prompts for a code sent to phone or SMS, support could work in a similar way as the emailed code. (--2fa-code perhaps?)

[MestreLion]

And, of course, the browser cookie should work to "bypass" both 2FA and emailed code, as you would be importing an authenticated session cookie. Use any browser cookie inspector and copy the value of _simpleauth_sess cookie using --auth. If it does not work, then maybe 2FA requires another cookie, so let me know.

[frioux]

Ok I got --auth to work; their cookie is pretty weird (including quotes an other escaped characters) so it was a little frustrating to get it to work. Thanks!

[frioux]

As for the 2FA, I don't think another flag could work, because you use your username and password, and then get prompted with the code. You'd have to have the tool block or something? I'm not sure.

[MestreLion]

No need to block I guess: just like the emailed code, on first run it would inform the user about the email (or, in this case, the SMS/phone 2FA) and exit, and the user runs it again providing the code via flag.

[frioux]

That's true, I hadn't considered that method.

sent from a rotary phone, pardon my brevity
On May 4, 2016 6:03 AM, "Rodrigo Silva" [email protected] wrote:

No need to block I guess: just like the emailed code, on first run it
would inform the user about the email (or, in this case, the SMS/phone 2FA)
and exit, and the user runs it again providing the code via flag.

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub
#10 (comment)

[MestreLion]

Is there anyone using 2FA willing to code this --2fa-code? I probably won't have time in the near future to do this :(