1067912 - New devices are added to the MFA device list before enrollment is completed

Status: RESOLVED WONTFIX

(Websites :: login.mozilla.com, defect)

Description

[Ed Morley [:emorley]]

In bug 1065644, I had Duo enabled on my account, even though I did not complete the process. We should not enable Duo on an account unless at least one device has been added.

Comment 1

[Ed Morley [:emorley]]

This happened again for me today.

Comment 2

[Corey Shields [:cshields]]

I don't see that changing anything here will have a positive impact in ~2 weeks when duo will be enforced for vpn and ssh (in other words, duo will be 'enabled' for everyone)

Comment 3

[Ed Morley [:emorley]]

I apologise for this bug being scarce on details - I'd add them in now, but I'm unable to add an MFA device after the "Bypass 2FA" option being enabled (see bug 1067914 comment 1 IRC excerpt; if there's a better way to fix that issue that let's me sign up when I'm ready in the future, please make the necessary changes).


STR (from memory due to the above, so might not spot on):
1) With an MFA device already added, start the process of adding another
2) Before completing the enrollment (eg before entering back the confirmation Google authenticator code), abort the process by going back to the login.m.o homepage
3) Click the MFA tab

Expected:
Only the device that was enrolled already is listed.

Actual:
There are now two devices listed, the one already enrolled, and the one for whom the enrollment was aborted

Comment 4

[Corey Shields [:cshields]]

(In reply to Ed Morley [:emorley] from comment #3)
> Expected:
> Only the device that was enrolled already is listed.
> 
> Actual:
> There are now two devices listed, the one already enrolled, and the one for
> whom the enrollment was aborted

Ah ok - that is a problem, yes.  Sorry it sounded like just the enforcement was happening without a full enrollment.

Comment 5

[Ed Morley [:emorley]]

No problem - when this bug was filed I think only one device could be added at a time, so comment 0 didn't make that distinction :-)

Comment 6

[Guillaume Destuynder [:kang] [this account is no longer active]]

Just a ping as complete rollout is next week. Not sure how many people have hit the bug and how important it is to prioritize, but wanna be sure you've seen it

Comment 7

[Rob Tucker [:rtucker]]

(In reply to Guillaume Destuynder [:kang] from comment #6)
> Just a ping as complete rollout is next week. Not sure how many people have
> hit the bug and how important it is to prioritize, but wanna be sure you've
> seen it

There's really nothing that can be done here. I've discussed this with :cshields and the best solution is we've added disclaimer text. DUO maintains state on their end. The barcodes are generated after the device has been added and activated in DUO.

Comment 8

[Rob Tucker [:rtucker]]

Per comment #7 and the lack of feedback indicating this is problematic, I'm going to close this out.