"Confirm username" modal is case-sensitive

[ngoldbaum]

When I try to turn off 2FA on my pypi account, after I am prompted to enter my username, the option to "remove application" on the warehouse web interface is grayed out. Unfortunately since I am changing phones today that means that I'll be locked out of my pypi account once my old phone is gone. It would be great if one of the warehouse maintainers could work with me to restore access to my account and re-enable 2FA. My username is ngoldbaum on freenode and I'm happy to chat about this in #pypa or #pypa-dev.

[di]

@ngoldbaum Just to confirm, you're attempting to remove an authentication application (TOTP) and not a security device (WebAuthn), correct?

Can you include a screenshot of what you're seeing? Also can you check your Javascript console for any errors?

[ngoldbaum]

I’ll try but unfortunately I’ve already moved my phone and no longer have access to the old TOTP app so I may be locked out of my account.

[ngoldbaum]

It looks like my session hasn't expired, see below:

[di]

Looks like this might be case-sensitive, can you try Nathan.Goldbaum instead?

[ngoldbaum]

Argh, I think that was the issue. Unfortunately I'm locked out of my account now :/

Is there some way for a pypa admin to manually disable 2FA on my account? I'm happy to prove I'm me somehow :)

[nlhkabu]

ping @ewdurbin for 2FA support

FYI @ngoldbaum, you (or other users) should not experience the same issue again, as we are replacing the 'confirm username' functionality with asking users to enter their password in #6527

[ewdurbin]

Hello @ngoldbaum, can you please email ernest[at]python[dot]org from the email address associated with your PyPI account? I can assist you in recovering access to your account.

[ewdurbin]

@ngoldbaum can you confirm your account access issues are resolved? I worked with the user to confirm ownership of the primary verified email address on the account as well as control of two major projects the user has access to.

[ngoldbaum]

Yup, thanks for your help!

[di]

The original issue still remains (the controller is case-sensitive and shouldn't be)