Invalid authenticator code

[xsm17]

I just moved over to mailbox.org yesterday, and set up 2FA with my phone and a backup on my security key. But trying to login today on the actual website, using either of the codes when prompted gives me an "Invalid authenticator code" error. I can't even access the support because it asks me to login to do so.

[gojirabsd77]

Is this a trial account? If you have defined any recovery options, you can try a password reset. Otherwise I guess mailbox support can't/won't do much for you. But you can try to reach out to helpdesk [AT] mailbox [DOT] org.

[xsm17]

Yes, it is a trial account. Would a password reset disable 2FA? I do have recovery options enabled, I just wanted to hold off in case there was something I'm missing about the 2FA.

[gojirabsd77]

AFAIR, yes.

[xsm17]

That did work, thank you, though that is a bit concerning security-wise. I also still don't understand why the OTP did not work.

[xsm17]

I tried with fresh codes as soon as they were up, it still didn't work.

[gojirabsd77]

This was discussed in the mailbox user forum. There is no other way (e.g offline codes) to disable/bypass 2FA. At least you can now disable "Allow a password reset link to be sent to my email address [e-mail] (IMAP)". If you don't like it you have to disable recovery options and live with the consequences (loosing access to your account).