Hi,

There is an issue with 2FA when logging in to:

https://git.devuan.org/

The correct PIN code is always invalid.

I run my own tool to generate the PINs, but I also tested using Google's
Authenticator app and it gives the same PINs at the same time.

I logged in with a recovery code, but couldn't login with a PIN.

Then I removed 2FA and tried to re-enable it. I cannot re-enable it now
because the PIN is always invalid....

The server time may be out, but I've also tried Google's server time as
the reference instead of git.devuan.org's time and it didn't help.

This was comparison of Google's time to my own local time:

1503649725    Fri Aug 25 18:28:45 2017    accounts.google.com
1503649724    Fri Aug 25 18:28:44 2017    local

And this was an earlier comparison using git.devuan.org server time:

1503649151    Fri Aug 25 18:19:11 2017    git.devuan.org
1503649036    Fri Aug 25 18:17:16 2017    local

As it stands now, I cannot re-enable 2FA with the account.

My Python code gets the server (https://git.devuan.org) time using curl
-Is with the "Date:" header.


--
Kind Regards
AndrewM

Andrew McGlashan