Hello Lemmy.World users,
yesterday we had an incident where human error lead to accidental removal of 2FA for all Lemmy.World users.
Until the mistake had been corrected and the original state had been restored where possible, 2FA was not enforced for any logins, even if the user enabled 2FA prior to this.
Timeline (all times in UTC):
Approximately at 2024-08-09 09:30 MFA had been removed for all users due to a mistake when MFA was intended to be reset for an individual user.
Around 2024-08-09 22:10 we became aware of the issue due to a user reporting that they were no longer prompted for 2FA on login. We immediately started an investigation to determine the root cause for this and discovered the mistake that was done earlier. Once the root cause was identified we started working on restoring the original state.
At 2024-08-10 01:10:00 2FA had been reactivated for all users that previously had 2FA enabled and hadn’t reactivated it on their own since.
After additional investigation to identify affected users with 2FA that had logged in during this period, we have sent out individual messages with information about logins to their accounts during this period.
Although less than 2% of our active users have 2FA enabled, we are committed to keep our user accounts as secure as reasonably possible, and we will review our processes for resetting 2FA for individual users going forward to reduce the risk of this happening again in the future.
Fortunately our robust backup database backups allowed us to revert the exact state we had just before this change happened, allowing us to restore the original 2FA secrets for all affected users.
During this period, we have observed a total of 824 logins. 18 of these logins were done by 14 users who had 2FA disabled. Notifications to all affected users who we observed logins for during this period have been sent shortly after publishing this post.
2 users had reactivated their 2FA already on their own, so we have not reverted their 2FA to the previous state.
If you have any concerns that your account may have been compromised during this period due to the lack of 2FA enforcement feel free to reach out to us via email to [email protected] or via PM to @[email protected].
I am guessing a large portion of those might be inactive accounts as well. When the reddit exodus was at its peak, there were definite issues with the way 2FA worked in lemmy. I think it got reset at one point due to changes made in subsequent lemmy versions and users had to re-enable it.
we were only counting users active in the last 6 months (based on lemmys active user stats) for this calculation. with the update to lemmy 0.19 back in march 2FA for all existing users was reset, so all users that had 2fa set up before and never reactivated it wouldn’t count towards this, nor would users that weren’t active at all since then.
Thanks for the clarification!
Yeah I’m still scared of switching on 2FA in case something goes wrong.
I once ended up locked out of a bunch of accounts because my phone with the authenticator app died. Oof.
Nowadays I use a TOTP dongle instead of an app and write down all of the keys in a paper notebook. Never again!