Should backup codes be viewable more than once? about django-allauth-2fa HOT 3 CLOSED

I guess the only reason they should not be shown is that if someone gains access to the account somehow they can use these tokens to get in on multiple other occasions but if an email was sent whenever a token is used then the account holder could just generate them again.

I have always found it slightly annoying when you cant see them again but I am sure they have other better reasons.

from django-allauth-2fa.

I agree! There's also weird things though where like in Google Apps for Business (or whatever the new name is); the account owner can actually see EVERYONE's backup tokens at any point.

Maybe this page should just require the user to re-authenticate with 2FA if they haven't done it in xx minutes (similar to #7).

from django-allauth-2fa.

Just a random thought: Should backup codes be used as a last resource when disputing an account? For example, someone was able to figure out my password. The 2FA is set to use SMS, but the mobile operators are insecure and the attacker would easily have access to the token sent there.

If the backup codes display only once when you sign up, then you can use this to assert you are the owner of the account.

from django-allauth-2fa.