Bitbucket: Two-step verification code rejected

[mrboring]

When I logged in yesterday two factor authentication did not work. I use Google Authenticator. Using a recovery code I got in.

I have now tried with both Google Authenticator and Authy. Both get the codes rejected. The codes for other sites work fine. I've tried disabling and re-enabling two-step verification within Bitbucket a few times. I also have Google Authenticator and Authy on both an Android phone and Android tablet, and have tried codes from both.

I've also confirmed that the date/time on my phone are correct.

I'm using Windows 10 Pro. I've tried with: Firefox 68 64-bit, Chrome 76 64-bit, Microsoft Edge 44.

Any ideas why tw-step verification codes are rejected?

[GP]

+1 to checking the date/time on your phone before going through support. This has been my issue more often than not. 

[Pietro Coelho]

I just had the same problem with google authenticator. Fixed by going into authenticator settings -> time correction for codes -> sync

[Michail Miheev]

If you have an easy password and you think that he needs double verification like your account, then of course you need to activate it and spend half an hour logging into your account. Or is there a way easier than to climb sites and applications confirming your account, it's just to come up with a password that is more difficult but remember it or write it down somewhere, and if you write it down according to yours, it’s dangerous and you’re lucky to have such a wonderful site like https://uk.verifywithsms.com/ which will record your data and provide you by SMS at any time convenient for you.

[Ana Retamal]

Hi there!

Thanks for reaching out and for sending us that screenshot. 

Are those Google Authenticator and Authy the apps that you got set up when you enabled 2fa? Seems like something went wrong and the apps are not giving you codes for the right application.

My recommendation would be to use a recovery code to get into your account, disable two-step verification, and then enable it again following the steps at Two-step verification. For the authentication app, the easiest method to set up the application is to scan a QR code with your mobile device.

Let us know how it goes,

Ana

[mrboring]

@Ana Retamal

I have it working, but now have a different issue.

When I log into Bitbucket I'm asked for a verification code for Atlassian, then one for Bitbucket.

I have 2FA enabled for both. That is because the Bitbucket account was set up before there was a requirement to use An Atlassian account to log in.

• Am I correct in thinking that I can only log into Bitbucket using an Atlassian account? If yes, why is 2FA still available in Bitbucket?
• Would I be reducing the security if I disabled the Bitbucket 2FA, but left the Atlassian 2FA enabled?

[tharsha]

You were able to solve the issue? Please share.

[Jason Taylor]

I am exp the same issue as the OP. I have even currently disabled the two step and every time I try to login in it ask for a two step verification even when disable. I tried to use the recovery key which dose not allow me in but just send me back to the two step verification page. 

[Scott Noring]

I am experiencing the parent issue in this thread as well as this last comment.  Please help as I have tried everything that is recommended several times.

[Morgan Gilroy]

I have the same issue, I can log into Atlassian and manage account etc but when i try to visit Bitbucket it prompts for Two-Step Verification, At this point i have disabled MFA on my Atlassian account but still get the prompt tying to access bitbucket.

FYI when i enable MFA on my Atlassian it works fine in that I can enter a code and log into Atlassian but still get a second prompt from Bitbucket. My issue has nothing to do with the time on my phone.

Please help, I am completely locked out of my code.

[tom.pallissery]

Hi @Morgan Gilroy , there is a 2FA setting at the bitbucket level also (Not just the Atlassian account level). You should disable that in order to stop bitbucket from asking you the codes. I hope you have the emergency codes with you which you might have received while setting up 2FA. If you have lost that too, the only way you can get in is by clicking forgot code, which will trigger the recovery email and atlassian team will get in touch with you.

[Morgan Gilroy]

@tom.pallissery ah, yes, thank you, I managed to log in ok a couple days after posting here, thankfully I figured it out and had the recovery codes so managed to get in as you suggested, once I had logged in I removed 2FA from the bitbucket account.

I can now log in as expected, via my Atlassian account with 2FA and I do not get  the second code prompt from Bitbucket.

[jamie]

I'm seeing this as well. I've checked the time of my system and my phone. I have 2 TOTP codes set up for my account, and a PassKey, and recovery codes. Spontaneously none of those are working. It makes me wonder, is it possible that the time is wrong on the Atlassian side?

Even more suspiciously, this is the second time in the last 3 months this has happened.