2FA Recovery Codes not showing when setting a second method.
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 21h 10m
- Merged PRs (30d)
- 635
Description
### Problem Statement
Users expect to have 2FA recovery codes automatically presented to them when setting up a 2FA method. Sentry does that when setting up 2FA for the first time in the account.
When setting a second method, for example, first setting up an authenticator app and some time later setting up a passkey, the recovery codes are not shown. This can cause confusion and bad UX when they are not presented with the codes.
Many services also show the codes only once (same as sentry does with auth tokens), which makes the situation worse.
### Solution Brainstorm
A simple solution would be to show the codes every time a new 2FA method is added, which also serve as a reminder to users to have them.
### Product Area
Unknown
Contributor guide
Research direction
No files or tests are named. Start by tracing the existing first-method 2FA setup flow that presents recovery codes, then compare it with the second-method flow; done means adding the same recovery-code presentation when another 2FA method is configured and covering the behavior with tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100