Lobsters 2FA: how to set up an authenticator app

Lobsters (lobste.rs) is an invitation-only community for sharing and discussing links about computing (Lobsters). Two-factor authentication (2FA) is optional, and there's one kind: codes from an authenticator app, added by the site's founder in February 2017 (Lobsters). There's no text-message option, no security key and, most important, no backup codes. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: Lobsters has no help center, so the Lobsters steps come from its own pages (the 2017 announcement, the About page and the administrator's profile) and from its source code and issue tracker on GitHub, all linked below. Screen labels are taken from the source code, and the issue-tracker comments we cite are by the administrator. We read them on October 20, 2026. We haven't tested the steps on a Lobsters account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you turn it on

Without backup codes, a lost authenticator means asking the administrator for a manual reset. Two things help:

• Keep a copy of the setup key. When 2FA launched, the founder suggested storing the secret itself, in a password manager or offline, instead of backup codes (Lobsters). Novaz keeps keys only on your iPhone unless you turn on iCloud backup or export a backup file, so a saved key or a Novaz backup is your self-service way back in. Guard it like a password.
• Link another account. Under External Accounts in settings you can Connect GitHub or Mastodon (Lobsters source). The administrator bases resets on the account's email address and linked accounts (Lobsters on GitHub).

Turn on 2FA with an authenticator app

These steps follow the settings pages in the Lobsters source code (Lobsters source, Lobsters source):

1. Log in at lobste.rs and select your username at the top of the page to open your settings.
2. Under Security Settings, find Two-Factor Auth. It reads Disabled. Select Enroll.
3. Type your password in Current Password and select Continue.
4. Lobsters shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is open on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. To type the key instead, open Reveal Secret under the QR code. In Novaz, tap +, then Enter key manually, enter Lobsters as the Service, and paste the key into Setup key. Lobsters uses standard 6-digit codes that change every 30 seconds, so either way works. See What is a 2FA setup key?
6. Select Verify and Enable. On the next page, type the current code from Novaz in TOTP Code and select Verify and Enable again.

Your settings now show Enabled next to Two-Factor Auth.

Finish within 15 minutes of entering your password, or the enrollment times out and you start again (Lobsters source). That makes a new key, so remove the unfinished entry in Novaz (Remove account) and scan the new code. Turning 2FA on also starts a fresh session, so other browsers where you were logged in will ask you to log in again.

Logging in from now on

After your E-mail or Username and Password, a second page asks for your TOTP Code. Type the code from Novaz and select Login. This happens on every password login, and resetting your password doesn't switch 2FA off: Lobsters still asks for a code afterward (Lobsters source).

If Lobsters rejects your code

Lobsters accepts the current code plus the one just before and just after it, which covers about 30 seconds of clock difference (Lobsters source). A code that keeps failing usually means the iPhone's clock is further off than that. Open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Turning 2FA off or moving to a new iPhone

To turn it off, select Disable next to Two-Factor Auth in your settings, enter your Current Password and select Disable Two-Factor Authentication (Lobsters source). It needs your password only, not a code. Then remove the entry in Novaz with Remove account.

So changing phones is easy while you're still logged in somewhere: turn 2FA off, select Enroll and set it up on the new iPhone. Do it before you wipe the old one. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. If a browser is still logged in to Lobsters, turn 2FA off there and enroll again.
2. If you saved the setup key, add it back to Novaz with Enter key manually.
3. Otherwise, contact the administrator, Peter Bhat Harkins (pushcx). His profile says to email his first name at push.cx "if you can't log in to message me" (Lobsters).

There's no form and no stated timeframe. In 2024 the administrator wrote that most people email him, and that a comment from the GitHub account linked to your Lobsters profile saves a round of email (Lobsters on GitHub). He has also said hand resets undercut what 2FA is for and floated replacing them with recovery codes, so don't count on one. See also Lost the phone with your authenticator app?

Official Lobsters pages

• Two-Factor Authentication now available
• About
• pushcx (administrator's profile)
• It's easy to lose access to two factor authentication. (GitHub issue #342)
• lobsters/lobsters source code on GitHub