Support

I had contributed the original code in Joomla! 3.2 but then other people modified it since. Thankfully the did not modify it so much as to be unrecognisable :D Since I am using both TFA features (Google Authenticator and YubiKey) on our own site I can help you.

The 403 you get? It's not coming from Joomla!. Go to Components, Admin Tools, Web Application Firewall, Configure WAF and click on Joomla! Feature Hardening Options. Find the "Forbid front-end Super Administrator login" and set it to No. Now you can edit your Super User. Afterwards, set "Forbid front-end Super Administrator login" back to Yes to protect your Super User against editing.

With the built in two way factor identification, is there a way to whitelist an Ip adresse?

No.

(That was actually the reason why we continued to use Admin Tools two way identification, because, having a fix ip at the office, we could login from the office without having to always use the google authenticator.

I suggest using a YubiKey instead. Have a different Super User account for each person at the office and link their account with one YubiKey for each person. Works like a charm – and yes, that's exactly what I'm using.

Another solution if you are using Mac OS X and iOS or Android devices is using Authy. The iOS/Android app is 100% compatible with Google Authenticator, it has a much better interface and syncs between devices. Moreover, they provide a small app which uses Bluetooth 4.0 LE (low energy) to connect a Mac with the mobile Authy client. When you need to fill in the TFA code you can just press a shortcut key combination (e.g. CMD-ALT-1) to have Authy connect to your iOS/Android device, create the TFA code and copy it to your Mac's clipboard. I've had mixed results with this feature so be warned: your mileage may vary.

I just noticed that Authy added a desktop application (actually: a Chrome application). This is really awesome! You no longer have to reach for your phone / tablet and type in the TFA code. Just open the app, copy the code, paste it to your page and you're done.