Two Factor Authentication on WP.org

Welcome to the MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. Team!

The Meta team is responsible for maintaining and managing WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ websites. Our work is mostly done on the meta trac. If you see a bug, file a ticket!

We’re currently working on these fine projects, with more in store.

Check out our handbook to learn how to get involved.

(Beta1). Based on the Two Factor pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party, a feature project for WordPress CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress., a first trial version of 2FA is now available on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/. While it’s not in a state yet suitable for rollout across the network, it is ready to be tested by a subset of users—based on ease of segmentation that’s Core Committers and users that are Super Admins. During the testing period it is only in place on login.wordpress.org and does not yet protect other parts of the network such as SVNSVN Apache Subversion (often abbreviated SVN, after its command name svn) is a software versioning and revision control system. Software developers use Subversion to maintain current and historical versions of files such as source code, web pages, and documentation. Its goal is to be a mostly compatible successor to the widely used Concurrent Versions System (CVS). WordPress core and the wordpress.org released code are all centrally managed through SVN. https://subversion.apache.org/. or TracTrac Trac is the place where contributors create issues for bugs or feature requests much like GitHub.https://core.trac.wordpress.org/..

Since 2FA is part of account security, the UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think ‘how are they doing that’ and less about what they are doing. to enable it will live in the support forumSupport Forum WordPress Support Forums is a place to go for help and conversations around using WordPress. Also the place to go to report issues that are caused by errors with the WordPress code and implementations. https://en.forums.wordpress.com/.’s profile page. From there, users can enable and disable it, as well as generate backup codes (alongside updating their password to a more secure one, generated by their favorite password manager).

Two Factor Authentication on WordPress.org will use a Time-based One-time Password Algorithm as the primary authentication method. Popular apps for that method are Authy or Google Authenticator, which make it easy to manage multiple accounts that are 2FA enabled. Secondary methods (in case users don’t have access to their phone) will be via email, SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/. (if 2FA is enabled there too), or printable backup codes.

All code is open-sourced and the work on this feature is trac’d in #77-meta, where you can follow along with the latest updates to this feature. In case there are not too many bugs uncovered during this first trial period, the current plan is to improve this enhancement over the next few weeks, and make it available to all users eventually.

+make.wordpress.org/core +make.wordpress.org/community +make.wordpress.org/test

Samuel Sidler 11:43 am on February 27, 2018

Since 2FA is part of account security, the UIUI UI is an acronym for User Interface - the layout of the page the user interacts with. Think ‘how are they doing that’ and less about what they are doing. to enable it will live in the support forumSupport Forum WordPress Support Forums is a place to go for help and conversations around using WordPress. Also the place to go to report issues that are caused by errors with the WordPress code and implementations. https://en.forums.wordpress.com/.’s profile page.

Curious why this decision was made, versus putting the UI in the BuddyPress profile. There’s been a desire to merge these two areas at some point, and a ticket exists for just that. Ideally, the support profile would only show support information, or go away entirely in favor of a WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/-wide profile, since support isn’t the only/main aspect of contribution to WordPress.org.
- Konstantin Obenland 12:10 pm on February 27, 2018
  
  You’re right on all points. The reason it was added to the support profile page was that it is also the only place to change passwords on wp.org and it falls in the same account security categoryCategory The 'category' taxonomy lets you group posts / content together that share a common bond. Categories are pre-defined and broad ranging..
  - t-p 5:57 pm on February 27, 2018
    
    I don’t see option for 2FA in my profile.
    I must be missing something!
    - Konstantin Obenland 10:11 pm on February 27, 2018
      
      Yep, for testing purposes it’s only enabled for
      
      a subset of users—based on ease of segmentation that’s CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. Committers and users that are Super Admins
      - t-p 8:00 pm on February 28, 2018
        
        Got it! Thanks 🙂
Austin Passy 7:08 pm on February 27, 2018

This is great news. I’ll be following development on GitHubGitHub GitHub is a website that offers online implementation of git repositories that can can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged be the repository owner. https://github.com/.
Weston Ruter 5:40 am on February 28, 2018

The OTP codes generated by Google Authenticator aren’t working for me. The code sent to SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/. is working, however.
- Konstantin Obenland 6:55 am on February 28, 2018
  
  Did you scan the QR code when setting it up or the text string?
Alex Shiels 6:25 am on March 8, 2018

Update: we’re disabling 2FA until it can be launched in full as a complete solution. Thanks to those who helped test!

Comments are closed.

WordPress.org

Welcome to the MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. Team!

Contact