{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Identity/issues/1700","repository_url":"https://api.github.com/repos/aspnet/Identity","labels_url":"https://api.github.com/repos/aspnet/Identity/issues/1700/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Identity/issues/1700/comments","events_url":"https://api.github.com/repos/aspnet/Identity/issues/1700/events","html_url":"https://github.com/aspnet/Identity/issues/1700","id":307175250,"number":1700,"title":"TFA Recovery codes discussion","user":{"login":"xrkolovos","id":517802,"avatar_url":"https://avatars2.githubusercontent.com/u/517802?v=4","gravatar_id":"","url":"https://api.github.com/users/xrkolovos","html_url":"https://github.com/xrkolovos","followers_url":"https://api.github.com/users/xrkolovos/followers","following_url":"https://api.github.com/users/xrkolovos/following{/other_user}","gists_url":"https://api.github.com/users/xrkolovos/gists{/gist_id}","starred_url":"https://api.github.com/users/xrkolovos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xrkolovos/subscriptions","organizations_url":"https://api.github.com/users/xrkolovos/orgs","repos_url":"https://api.github.com/users/xrkolovos/repos","events_url":"https://api.github.com/users/xrkolovos/events{/privacy}","received_events_url":"https://api.github.com/users/xrkolovos/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-03-21T09:45:24Z","updated_at":"2018-03-22T15:58:04Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\nmy Version\r\n`<PackageReference Include=\"Microsoft.AspNetCore.All\" Version=\"2.0.6\" />`\r\n\r\nI created the latest startup project of asp.net core with Identity (local stored account in my sql). I created a new user and went to enable TFA. I got the recovery code and tryied the TFA. Login wokrs fine, but LoginWithRecoveryCode always fail with message \"Invalid recovery code entered\". \r\n\r\nMy recovery code is as i copied it from the webpage.\r\n\r\n```\r\nef3899d4 97bf06ad\r\nb8927df8 6ad00f89\r\nec5e6e30 17872076\r\n1ac5ca54 c8ec38a6\r\n2fed51c8 c7a063e9\r\n```\r\n\r\nI try to past it in 4 ways\r\n\r\n```\r\n//1 as i copied it\r\n//2 ef3899d4 97bf06ad b8927df8 6ad00f89 ec5e6e30 17872076 1ac5ca54 c8ec38a6 2fed51c8 c7a063e9\r\n//3 ef3899d497bf06adb8927df86ad00f89ec5e6e30178720761ac5ca54c8ec38a62fed51c8c7a063e9\r\n//4 ef3899d4;97bf06ad;b8927df8;6ad00f89;ec5e6e30;17872076;1ac5ca54;c8ec38a6;2fed51c8;c7a063e9\r\n```\r\nThe 4th way is as copied from the database. \r\n\r\nnone of this wokrs. \r\n\r\nthank you."},"comment":{"url":"https://api.github.com/repos/aspnet/Identity/issues/comments/375358983","html_url":"https://github.com/aspnet/Identity/issues/1700#issuecomment-375358983","issue_url":"https://api.github.com/repos/aspnet/Identity/issues/1700","id":375358983,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars0.githubusercontent.com/u/649492?v=4","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2018-03-22T15:58:04Z","updated_at":"2018-03-22T15:58:04Z","author_association":"NONE","body":"> What do you think encrypting the codes would give you here? You still need a valid password, they're for use when you don't have your 2fa app.\r\n\r\nI always try to protect the identity system with the assumption an attacker has read-only access to the DB. Thus, protecting access tokens, 2FA codes, 2FA reset codes, email confirmation codes, etc. In ASP.NET Identity some of these values are protected by virtue of data protection and not storing them in the DB. But many other values are in the DB... in plain text. "}}
{"actor":{"display_login":"brockallen"}}