Search

Hello Lemmy.World users,

yesterday we had an incident where human error lead to accidental removal of 2FA for all Lemmy.World users.
Until the mistake had been corrected and the original state had been restored where possible, 2FA was not enforced for any logins, even if the user enabled 2FA prior to this.

Timeline (all times in UTC):

Approximately at 2024-08-09 09:30 MFA had been removed for all users due to a mistake when MFA was intended to be reset for an individual user.
Around 2024-08-09 22:10 we became aware of the issue due to a user reporting that they were no longer prompted for 2FA on login. We immediately started an investigation to determine the root cause for this and discovered the mistake that was done earlier. Once the root cause was identified we started working on restoring the original state.
At 2024-08-10 01:10:00 2FA had been reactivated for all users that previously had 2FA enabled and hadn't reactivated it on their own since. After additional investigat