Login+

Hello everyone, today Login+ gets its first update — four new features and a big round of security hardening, fully translated into English and Russian!

• Added one-time 2FA backup codes: enabling 2FA now gives you 8 single-use codes like XXXX-XXXX that log you in if you ever lose your authenticator, Discord or Telegram — check how many are left with /2fa status, generate a fresh set with /2fa backup <password>, and the account owner gets a security alert whenever one is used; only hashes are stored, so the codes can never be read back, not even by the server owner

• Added account migration from other auth plugins through /loginplus import <authme|nlogin> [file], which imports names, registration dates, IPs and recovery e-mails from the AuthMe or nLogin database (SQLite); old password hashes keep working and are upgraded to Argon2id automatically at each player's first login, so players notice nothing at all

• Added forced 2FA for staff: anyone with the new permission loginplus.require2fa (or every operator, with the new config option two-factor.require-for-staff.ops) is frozen after logging in until they finish /2fa setup — skipped automatically while no 2FA method is enabled, so a config mistake can never lock your team out

• Added Telegram one-tap login approval — login requests now arrive with ✅ It's me / ❌ Not me buttons, one tap logs you in or kicks the attacker, and typing the 6-digit code still works as a fallback (new config option two-factor.telegram.one-tap-approve, on by default)

• Improved the /loginplus help, which now lists one command per line with a short description instead of cramming everything into a single line, matching the /2fa and /email style

• Fixed password checks in /changepassword, /unregister, /2fa disable and /email remove having no attempt limit, which let a stolen session brute-force the account password unnoticed and spam the server with heavy hash computations; three wrong passwords now lock these commands for a while and warn the account owner via Discord/Telegram

• Fixed e-mail recovery codes being guessable by command spam — three wrong tries now invalidate the code and end the connection

• Fixed the e-mail cooldown resetting when a player rejoins, which could be abused to flood someone's inbox with recovery mails; the cooldown is now tied to the account and survives relogging

• Fixed /2fa resend having no cooldown, which allowed flooding a player's DMs with login codes — requesting a new code now has a 30-second cooldown

• Fixed 2FA setup confirmation codes never expiring and accepting unlimited guesses; they now expire after 10 minutes and are dropped after three wrong attempts, and e-mail confirmation codes got the same three-attempt limit

• Fixed e-mail recovery codes being guessable by command spam — three wrong tries now invalidate the code and end the connection

• Fixed the e-mail cooldown resetting when a player rejoins, which could be abused to flood someone's inbox with recovery mails; the cooldown is now tied to the account and survives relogging

• Fixed /2fa resend having no cooldown, which allowed flooding a player's DMs with login codes — requesting a new code now has a 30-second cooldown

• Fixed 2FA setup confirmation codes never expiring and accepting unlimited guesses; they now expire after 10 minutes and are dropped after three wrong attempts, and e-mail confirmation codes got the same three-attempt limit

Updating from 1.0.0 is a drop-in: just replace the jar — the database and config upgrade themselves, and customized message files keep working.