[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"journal-post-sm-mfa-plugin-0-1-2":3},{"author":4,"categories":8,"content":13,"content_html":14,"created_at":15,"excerpt":16,"featured_image_url":13,"featured_images":17,"id":18,"is_pinned":19,"metadata":13,"next_post":20,"previous_post":24,"published":28,"published_at":29,"reading_time":6,"related_posts":30,"slug":31,"sources":13,"tags":32,"title":33,"translations":13,"updated_at":34},{"first_name":5,"id":6,"last_name":5,"login":7},"",1,"jakubzych@gmail.com",[9],{"id":10,"name":11,"slug":12},3,"Plugins","plugins",null,"\u003Ch2>Highlights\u003C\u002Fh2>\n\u003Cp>sm-mfa-plugin 0.1.2 closes several gaps around second-factor challenges.\u003C\u002Fp>\n\u003Ch2>Fixed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>A ban or password change ends the user's pending login challenges. Every verify route refuses a banned user, a user suspended at the verifying address, or a user who changed their password after the challenge was created.\u003C\u002Fli>\n\u003Cli>Completing a challenge is all-or-nothing: the spent code, the trusted device and the issued session commit together, so a failure no longer burns a recovery code without signing the user in.\u003C\u002Fli>\n\u003Cli>A wrong password on the recovery-code routes counts as a failed login, so those routes can no longer be used to guess a password past the login throttle.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Changed\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>A password change demotes the user's passkeys to second-factor keys, so a passkey added from a stolen session does not outlive the password change. Users who change their password register their passkeys again for password-free sign-in.\u003C\u002Fli>\n\u003C\u002Ful>\n","2026-10-26T15:43:18+00:00","Challenges end on ban or password change, all-or-nothing completion, and throttled password confirmation.",[],43,false,{"id":21,"slug":22,"title":23},42,"sm-user-plugin-0-1-13","sm-user-plugin 0.1.13",{"id":25,"slug":26,"title":27},44,"sm-sociallogin-plugin-0-1-5","sm-sociallogin-plugin 0.1.5",true,"2026-10-26T15:40:04+00:00",[],"sm-mfa-plugin-0-1-2",[],"sm-mfa-plugin 0.1.2","2026-10-29T10:39:25+00:00"]