Legal Robot · Report #249339
Missing link to TOTP manual enroll option
Validstatus
mediumseverity
12upvotes
31 Jul 2017disclosed
Summary
While going live with additional 2FA options, a security researcher discovered that during TOTP enrollment, only a barcode was displayed to users, no TOTP manual enroll option with a printed base32 secret was provided for non-smartphone users.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.