{"action":"created","issue":{"url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/issues/11","repository_url":"https://api.github.com/repos/julien731/WP-Google-Authenticator","labels_url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/issues/11/comments","events_url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/issues/11/events","html_url":"https://github.com/julien731/WP-Google-Authenticator/issues/11","id":52595146,"number":11,"title":"Move the auth code from the main login form to a second step","user":{"login":"julien731","id":1441024,"avatar_url":"https://avatars.githubusercontent.com/u/1441024?v=3","gravatar_id":"","url":"https://api.github.com/users/julien731","html_url":"https://github.com/julien731","followers_url":"https://api.github.com/users/julien731/followers","following_url":"https://api.github.com/users/julien731/following{/other_user}","gists_url":"https://api.github.com/users/julien731/gists{/gist_id}","starred_url":"https://api.github.com/users/julien731/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julien731/subscriptions","organizations_url":"https://api.github.com/users/julien731/orgs","repos_url":"https://api.github.com/users/julien731/repos","events_url":"https://api.github.com/users/julien731/events{/privacy}","received_events_url":"https://api.github.com/users/julien731/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/labels/feature%20request","name":"feature request","color":"eb6420"},{"url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/labels/wontfix","name":"wontfix","color":"ffffff"}],"state":"closed","locked":false,"assignee":{"login":"julien731","id":1441024,"avatar_url":"https://avatars.githubusercontent.com/u/1441024?v=3","gravatar_id":"","url":"https://api.github.com/users/julien731","html_url":"https://github.com/julien731","followers_url":"https://api.github.com/users/julien731/followers","following_url":"https://api.github.com/users/julien731/following{/other_user}","gists_url":"https://api.github.com/users/julien731/gists{/gist_id}","starred_url":"https://api.github.com/users/julien731/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julien731/subscriptions","organizations_url":"https://api.github.com/users/julien731/orgs","repos_url":"https://api.github.com/users/julien731/repos","events_url":"https://api.github.com/users/julien731/events{/privacy}","received_events_url":"https://api.github.com/users/julien731/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2014-12-21T13:26:51Z","updated_at":"2016-03-27T05:45:03Z","closed_at":"2016-03-26T16:47:47Z","body":"As [suggested by MJP](https://wordpress.org/support/topic/a-suggestion-and-request), the auth code could possibly be moved to a second step. It would make things clearer for users who are **not** using the 2FA."},"comment":{"url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/issues/comments/201994810","html_url":"https://github.com/julien731/WP-Google-Authenticator/issues/11#issuecomment-201994810","issue_url":"https://api.github.com/repos/julien731/WP-Google-Authenticator/issues/11","id":201994810,"user":{"login":"cleanforestco","id":653153,"avatar_url":"https://avatars.githubusercontent.com/u/653153?v=3","gravatar_id":"","url":"https://api.github.com/users/cleanforestco","html_url":"https://github.com/cleanforestco","followers_url":"https://api.github.com/users/cleanforestco/followers","following_url":"https://api.github.com/users/cleanforestco/following{/other_user}","gists_url":"https://api.github.com/users/cleanforestco/gists{/gist_id}","starred_url":"https://api.github.com/users/cleanforestco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cleanforestco/subscriptions","organizations_url":"https://api.github.com/users/cleanforestco/orgs","repos_url":"https://api.github.com/users/cleanforestco/repos","events_url":"https://api.github.com/users/cleanforestco/events{/privacy}","received_events_url":"https://api.github.com/users/cleanforestco/received_events","type":"User","site_admin":false},"created_at":"2016-03-27T05:45:03Z","updated_at":"2016-03-27T05:45:03Z","body":"Hi @julien731, thanks for the detailed reply. The idea is solid as it would increase usability, but it sounds like the implementation has some theoretical limitation.\r\n\r\nThe limitation seem to be how step 1 communicates to step 2 that the username and password is correct. A nonce passed via $_GET is obviously problematic and would weaken the authentication. (The Codex specifically says, \"always assume Nonces can be compromised.\")\r\n\r\nI'm wondering if wrapping the function which displays the TOTP field in current_user_can() would protect against someone correctly guessing the nonces?"}}