Henrik Schacks blog

This is a great plugin and I am now using it on my website.

But, I have a question in my mind. What if I lost my mobile phone, than how will I be able to login to WordPress? Do you have any plans for providing other verification methods like backup codes or something similar that Google provides, in case something like that happens to anybody?

Hi Henrik, thanks for writing this. It’s a great plugin.

- David Bullock

I installed this and scanned the QR code but the authenticator app said “Invalid token”. I entered the code manually (selecting time counter) but when I tried to login with it, the code generated by the Authenticator app didn’t work. Changed the plugin folder name and disabled it to log back in.

Hi Henrik,

this is a very nice idea for a plugin! I really like it!

I have question though: Where did you learn how the algorithms for Google Authenticator work? Can you point me to a description or documentation?

Thanks!
Tobias

Not sure why but it didn’t work for me. After I enabled the plugin and update the admin user account, I tried to logon using my existing password with the google authenticator code and it still complained about password incorrect. Once I deleted the plugin I am able to logon again.

Hi Hendrik,

first of all, thanks for the perfect work, the idea of the plugin is great and secure as well! My problem is, that since the update to WordPress 3.2 the plugin seems to get in trouble – every time I try to login I get the error message that my Google Code is not valid anymore or wrong. The only chance I have is to delete your plugin via ftp and then login usually. I reinstalled your plugin, did create a new secret code for my user and scaned it with my phone, with the same result? Do you know anything about that behaviour?
Thanks,
Bent

Hi Henrik and Tobias,

I found the problem: My phone (HTC Desire) was getting its time from my cell provider. I checked the time with the very smart tool ClockSync that reported an offset of approx. 30 seconds (which is probably too much for a time based 2 factor authentication).
Yesterday I rooted my device and now I’m able to sync my clock via ntp (with an offset of 0,1 seconds) and everything is working perfect!!!

Maybe you can tell the customers that fact as a hint in the plugin description or in the faq section?

Regards and thanks again for the plugin,
Bent

Henrik,

Have you considered an option to check the preceding and following minute for matches?

That would give a 180 second window to dampen the clock drift issues.

If it was selectable as an option, those of us with accurate clocks could disable it for best security, new users could leave it on by default to deal with sloppy clocks.

You could also log or notify admin if the match was on the edge (not against the server time). That would not only cut down on the support issue of “doesn’t work”, and it could notify the admin of a potential problem if they’re not properly syncing their server time.

Best,

Dave

I just installed the plugin, but when I scan in the QR code with my iPhone Google Authenticator app, it gives me an error about not being a valid authentication token barcode. Any ideas on how to fix this? Thanks.

I’ve written a pretty accurate account of how the google TOTP works:

http://www.idontplaydarts.com/2011/07/google-totp-two-factor-authentication-for-php/

The hardest part of the whole implementation is probably the Base32 decode.

Your Google Authenticator for WordPress is great, however currently is very dependent on time-sync (and third party Android time sync apps seem to require root). Google’s libpam-google-authenticator provides an optional relaxed mode where you have a +4/-4 minute sliding window of accepted codes. Which effectively means 17 codes are accepted at any one time. Would you consider adding such option to your WordPress plugin at some point?

Regards,
Pascal de Bruijn

Awesome! Works like a charm!

Henrik, thank you for this plugin. I wanted to suggest a possible option to add. I have required GA for admins, but I leave it off for the majority of my users. But then they find the field confusing on the login screen. Would you consider adding an option to hide the field by default but maybe reveal it with a click so that admins could still enter the code, but normal users don’t see the field? Just a thought.

Yeah, that would be great. What would be even greater would be the ability to edit what that explanation IS in the admin somewhere! Then I could gear it specifically to my users.

Hmm, this does not seem to be working for me unfortunately. Everything appears to be working, except it simply won’t log me in

I’m running WordPress trunk on a sub-domained multi-site installation in case that’s of any use in debugging.

I had a flick through the code but couldn’t see anything in particular which was out of place.

Oh! I didn’t click that the server time needed to be in sync. I thought the references to time syncing was referring to ensuring that the authenticator hadn’t timed out before entering the number.

That is most likely the problem then as I assume the times will be out by around five hours or so.

I’m guessing you have set it to work off of the server time itself rather than the users time in WordPress.

A better option would be to use the time zone set within WordPress itself by individual users. This can be set in each users profile page.

If it is based on the server time, then it will unfortunately be unusable for any WordPress installs with multiple users in different time zones.

Great plugin idea. Just not usable for me if that is how it is setup unfortunately. I’ll gladly help promote it for you if it starts using each users individually set time though A plugin like this is ideal for people like myself who run multi-site networks as we need to be a bit more careful with security than our single site install colleagues.

In the mean time, I might check out your WordPress port of Steve Gibsons paper passwords. I considered writing a plugin for than when I heard Steve and Leo talking about it the other week, but decided not to as I decided that using a Google multi-factor authentication plugin would be more sensible.

My apologies. There is no option for that at all unfortunately.

What you can do though is use the site wide time zone set via /wp-admin/options-general.php.

Darn. Well I guess it isn’t working for some other reason then

I thought may be it would help if I used the root site for my network in case it was using the time settings for that site within the plugin, but no luck. That didn’t work either

My server time definitely doesn’t match the time on my phone. However time listed in WordPress is accurate.

Oh man! I finally solved it. I was suffering from two problems which were switching on me. I was sometimes using the wrong “description” and sometimes my time was out of whack.

Thanks so much for your assistance. Plugin is working great now Sorry for taking up so much of your time.

Just curious as to how the login works exactly. What I mean is that once I type in the username, password and GA code and I tell WordPress to remember me and tell my browser to save the username and password, how often will I have to retype in the GA code?

I’m testing it on my laptop and it seems it will continue to log me in without having to type in the code, which is perfectly fine, I don’t want to type it in every single time, especially if I haven’t closed my browser.

But is there a time limit? Also, what about a different computer that was already setup to login without having to enter the username and password? Is there some mechanism to make sure the person has to type in the code even if the credentials are saved?

Thanks,

Aseem

Hi Henrik,

Sorry what I was asking about is when you already have your login info saved? For example, I installed the plugin and then clicked “Remember Me” before clicking login. I also let my browser save my username and password. Now it’s been 2 days and I am able to just click a direct link to my wp-admin section and I don’t have to type in any GA code. I only have to do it when I manually log out of WordPress or when I log into my blog on a new computer that I have not used before. Is that how it’s supposed to work?

Thanks,

Aseem

Does this support authentication via SMS, or just the Android app? I log in to my Gmail account by typing a code I get sent to my phone via SMS.

Awesome plugin, just installed it on a couple of WP sites I run.

I was getting the ‘Invalid Token’ error message when I tried to scan the QR code (on iPhone) as well, removing spaces from the description seemed to fix it.

Hi Henrik,

Today I have installed Google Authenticator for WordPress and everything went great install wise.
Allthough as soon as I test the module I can just skip the login screen by not entering the OTP.
This baffles me since The Google Authenticator module should block my login attempt.

Have you heard of this before, if so are you familiar with a fix for this strange issue?

Thank you for reading & kind regards,

Luuc

Hello Henrik,

Thank you for your quick reply!
Actually I did activate Google Authenticator under: ‘Users’ > ‘Lucas’ > ‘Google Authenticator Settings’ > ‘Active = √’.

Is this what you are referring to? If so, what else could I do to fix this?
When I log in, the only way for me to login is to leave the Google Authenticator Field blank.

Thank you again for reading.
Very kind regards,

Lucas.

Hi Henrik,

Thanks again for your quick reply, truly fantastic!
Our blog is in Maintenance mode at the moment. Just now I have turned it off to see if it would make a difference, unfortunately it doesn’t. We have also tried restarting our server. This also makes no difference.
If you do not have an answer right away I understand completely.

Thanks again,

Kind regards,

Lucas.

Hello again Henrik,

Absolutely! If you have the spare time to do so then you are more than welcome!
If I can do anything for you to help in finding a solution then please ask .

Thusind Tak!

Lucas.

I had problems with Authenticator not reading QR code. However I removed the spaces from the name and it worked fine.

Cool plugin thanks!

Hi! For web browser it works fine! Unfortunately I can’t login with my WordPress-App (WordPress 2.0 for Android). Is there a solution for that issue?

Great plug-in!

You might want to set autocomplete=”off” for the input on the login page, so that browsers don’t offer old codes.