Use simple number input field for 2fa codes #476

New issue

Open

opened 2026-06-18 14:04:53 -05:00 by Ra72xx · 2 comments

Ra72xx commented

2026-06-18 14:04:53 -05:00

(Migrated from github.com)

Currently, in VoidAuth you have 6 single-digit input fields for the 2fa code. Which means that, depending on OS, browser, device, copy/paste actions from Bitwarden/Aegis/whatever might work or might not work. At least for me, I have to struggle all the time. In the worst case, you have to enter number by number (and to delete number by number if you were to slow and have to take another chance).
Is there any reason why VoidAuth does not use a standard input field for all digits of the 2fa code together? Other authentification providers do this, so I guess it should not be a security problem?

Currently, in VoidAuth you have 6 single-digit input fields for the 2fa code. Which means that, depending on OS, browser, device, copy/paste actions from Bitwarden/Aegis/whatever might work or might not work. At least for me, I have to struggle all the time. In the worst case, you have to enter number by number (and to delete number by number if you were to slow and have to take another chance). Is there any reason why VoidAuth does not use a standard input field for all digits of the 2fa code together? Other authentification providers do this, so I guess it should not be a security problem?

notquitenothing commented

2026-06-18 19:07:50 -05:00

(Migrated from github.com)

Interesting, paste events should be intercepted and parsed correctly depending on which input you pasted into. Similarity typing events should be caught on those inputs so that the next field is automatically selected on entry (and the previous selected on backspace/delete). It is set up this way because I thought it looked cool, not for any security reason. Would you mind sharing your OS/browser and maybe any extensions you think might be interfering, so I can attempt to replicate?

Ra72xx commented

2026-06-22 15:08:32 -05:00

(Migrated from github.com)

It's not that copy/paste does never work, it simply is completely unreliable (or maybe somehow breaks my muscle memory for copy/paste?). Maybe the window switch between password manager and browser breaks your mechanism of catching input events? I have to select the leftmost input field instead of simply clicking somewhere in one single input field, and then copy/paste might work. For now I have simply turned to memorizing the code and then enter it by hand as this at least works all the time.

Previously I used Authentik, and here Bitwarden was able to even propose the correct number code for autofill of the input field, this does not work with VoidAuth.

It's especially bad if you have to enter the number again In a standard input field, you juat click into the field, all content is selected and entering the correct code simply overwrites the existing value. With VoidAuth, I have to mark every simple digit seperately and replace it with the correct one.

So maybe you might reconsider your mechanism, especially if it is some hack implemented for optical reasons? Apart from that, I'm really satisfied with my switch from Authentik to VoidAuth.

I use Brave (or Android Web View) on standard Android/LineageOS and Linux/Ubuntu devices. For password management, I use Bitwarden (browser addon and app) and e.g. Aegis on Android. So nothing really fancy. It's not that copy/paste does never work, it simply is completely unreliable (or maybe somehow breaks my muscle memory for copy/paste?). Maybe the window switch between password manager and browser breaks your mechanism of catching input events? I have to select the leftmost input field instead of simply clicking somewhere in one single input field, and then copy/paste might work. For now I have simply turned to memorizing the code and then enter it by hand as this at least works all the time. Previously I used Authentik, and here Bitwarden was able to even propose the correct number code for autofill of the input field, this does not work with VoidAuth. It's especially bad if you have to enter the number again In a standard input field, you juat click into the field, all content is selected and entering the correct code simply overwrites the existing value. With VoidAuth, I have to mark every simple digit seperately and replace it with the correct one. So maybe you might reconsider your mechanism, especially if it is some hack implemented for optical reasons? Apart from that, I'm really satisfied with my switch from Authentik to VoidAuth.