Users deleting 2fa without removing backup keys

[MaxHayman]

Hey,

I get A LOT of support requests from people who remove otp but forget to remove backup keys and log out.

Can we have some option which requires Backup keys to be removed before or when they remove OTP?

[paul999]

Hmm, I am not fully sure what the best way to solve is. Technically, it is a perfect valid situation to just have backup keys, so I don't want to really force it to have them deleted. But I can see how it might be causing issues. I will need to think a bit more about this

[Aminuxer]

Static backup keys for users without main 2FA secrets can be found by this SQL query:

SELECT t1.*
FROM `phpbb_tfa_back_reg` t1
WHERE t1.user_id NOT IN
     (SELECT DISTINCT t2.user_id FROM phpbb_tfa_otp_reg t2)