tvirelli

I have 2FA on one of my web apps. Most users are using Google Authenticator which uses TOTP (Time-Based One-Time Password). On first login, we show them a QR code. We instruct them to save a copy of this QR code in the event they get a new phone or want to install a new 2FA app. However, I am running into a situation where users are not doing this. I can easily enough reset their account to show a QR code again on next login, but my question is: What is the safest way to "authenticate" them for a reset? I could do things like send a reset email to the email associated with the account, but I am just wondering what others are doing for situations like this. I want to make sure I am doing it as securely as possible.

Thanks!

Hey guys, just thought I'd share that I wrote a 100% free (no ads) app for both iOS and Android to help you monitor your mining progress and payouts is you are using the Eligius Pool. Here are the links:

iOS: https://itunes.apple.com/us/app/eligius-pool/id1070165490?mt=8

Android: https://play.google.com/store/apps/details?id=com.nuwex.eligiusst

Let me know what you think and if you have any suggestions let me know!

Thanks

My company has been looking for a time tracking software (web based) that allows the employees to punch in/out as well as track task time. We have found many solutions for just tracking task time, but nothing that also allows for tracking separate punch in/out time. Any suggestions?