WPIntell

Source evidence

Encrypt keys in database

Two Factor Authentication · support · 2023-08-16T19:35:00+00:00

Two Factor Authentication plugin evidence original source source API
questionsentiment
highseverity
0.83relevance
1replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

7 / 33 rows with source links

21.2% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

26 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
julivgar resolved
Hello Devs, I accidentally enabled the “Encrypt keys in database” under settings and it says “ Encrypt keys in database has been enabled. This feature cannot be turned off .” I was wondering what does it do? I’m afraid that I might’ve encrypted something that I can not retrieve. This is encryption of your TFA keys in your database. The encryption key is on disk in the wp-content/mu-plugins directory. The only bad thing that can happen would be if you deleted the file with the encryption key, and that would mean the keys could not be accessed, and then you would have to disable the TFA plugin in order to login. Basically it’s an extra security measure: if someone hacks your database, then your encryption keys used for TFA are still secured, so the hacker still can’t guess your TFA codes even if he possesses a full copy of your database. David

Comments

1 shown
David Anderson / Team Updraft 2023-08-16T20:36:00+00:00

This is encryption of your TFA keys in your database. The encryption key is on disk in the wp-content/mu-plugins directory. The only bad thing that can happen would be if you deleted the file with the encryption key, and that would mean the keys could not be accessed, and then you would have to disable the TFA plugin in order to login. Basically it’s an extra security measure: if someone hacks your database, then your encryption keys used for TFA are still secured, so the hacker still can’t guess your TFA codes even if he possesses a full copy of your database. David