Hi,

This does not work on vBulletin 4.4.2 i mean it installs fine and it will let you setup the 2factor authentication after clicking the save button it says "2factor authentication has been enabled" and it logs you out but i can login again just with my username and password then when i goto the section under "myaccount" it shows me the setup screen again that is not the way 2factor authentication should work.

Do you mean 4.2.2? Did you follow all of the steps as laid out in the instructions?

Oops yes 4.2.2 PL 1 i install it like this

1. upload the "dbtech" folder to public_html
2. import the product XML via vBulletin productmanager
3. goto domain.com/vbpath/profile.php?do=twofactor&action=enable
4. Save the recovery key and scan the QR and save to Google Authenticator => click save

after that i logout to see if it works but i can login with my username and password and no verification code is being asked.When i goto to profile.php?do=twofactor again then a verification is asked strange if you ask me.

Nice plugin :)

Could sound silly, but what is the following:

Permissions

• Can View
• Can Add User Channel

that sounds like permissions but there is no "bitfield_productname.xml" in the zip so that is useless unless ofcource vBulletin changed the way permissions are implemented.


I don't see a plugin at any hooklocation that involves the loginproces so how is this seposed to work ?

Hi,

Problem solved it seems this hack uses a DB table to verify ip addresses if your ip is verified no twofactor code is being asked however if you try to login with another computer (that has another ip) a verification code will be asked)

Correct :)

Sorry, that was a copy/paste mistake. It's been removed from the description.


Fillip

Users are complaining that on phone devices the website will re-direct them back to the validation code on login after they have already submitted it.

i.e.
1. They login; username & password
2. Validation code.
3. Validation code accepted, and redirects them back to "2."

I've received this complaint regarding iPads and iPhones.
I have tested myself with iPad, but no problems.

I will still continue to test and gather more info.

I suspect their wireless providers have an IP changing on every page request, which would make it difficult to validate properly.

Might need a cookie set so the IP doesn't have to match.

That would be nice. Or a device ID based authorization?
http://twofactorauth.org/providers/

SecureAuth seems to be the best one, but I'm still searching on how to implement it on vbulletin....