Account Security

• 

  fixball · Member · Apr 3, 2022 at 11:27 pm

  • Copy link
  • Add topic to favorites

  My Fixball site currently has 2-step verification.
  However I have not had a cellphone, let alone access to the number registered with WordPress [redacted], for over a year, but I do not seem able to cancel 2 step verification without access to it.
  Can you please either immediately cancel 2-step verification on Fixball or email me explaining how I can cancel it without access to a cellphone?
  Many thanks.
  ‘Fixball’

  WP.com: Yes
  Correct account: Yes

  The blog I need help with is: (visible only to logged in users)

• 

  fstat · Staff · Apr 4, 2022 at 12:30 pm

  • Copy link

  Hi there,

  I see that you’ve generated backup codes. You can use one of those codes to disable the two-step verification.

  If you don’t have access to those codes, let me know and I’ll see what else I can do.

• 

  fixball · Member · Apr 4, 2022 at 8:15 pm

  • Copy link

  Dear Fstat

  Thanks for your prompt response.

  I did generate backup codes yesterday, twice!, because I’d used an old one to get access to my account in the first place & then the first new backup code I was given was rejected.

  I do not tho recall seeing any option to use a backup code to delete 2-stage verification yesterday even tho I am certain I used the same process today when that option was clearly given.

  Whilst that seems odd, my question today is why doesn’t WordPress offer 2-stage verification using email or even the same backup codes as those when a cellphone is unavailable?

  Thanks again.

  Paul

• 

  helper-heroponriki · Member · Apr 4, 2022 at 8:28 pm

  • Copy link

  You can see all your options for Two Step Authentication here including using an Authenticator app or SMS:

  https://wordpress.com/support/security/two-step-authentication/

  With our system, you can only use one of those two and your “backup” would be to use those single use backup codes that you generated. Using email as a backup is highly insecure and can be easily used or spoofed to gain control of your account.

  Also note that your list of backup codes is only valid until you use them all up or you generate a new set of backup codes – for security reasons generating new codes will invalidate the previous ones.

  If you decide to disable Two Step, you can follow the steps here:

  https://wordpress.com/support/security/two-step-authentication/#disable-two-step-authentication

  I hope that clarifies things!