<...>
sebenernya sih pake stake/sign message bukan lebih aman, tapi sebagai bukti kalo kita yang punya itu akun ketika di hack. (tetep aja masih bisa diambil alih) jadi alangkah baiknya kalo ditambah pake google authenticator. seperti yang sudah diterapkan di exchange. sebagai pengamanan awal, baru kemudian diisi sign message juga buat jada jaga kalo masih bisa dijebol juga

Not only do I believe you're right, it probably is too difficult or too risky to integrate into the forum in it's current state, but there is already an endless sea of "Account lost" threads, where people reset their passwords and lose their accounts, simply forget their passwords or goof their recovery questions. I think that until we have a decent solution for these people, adding 2-FA will only serve to exacerbate this problem. Then, you have to consider that even allowing user stats, images, new-tab and other features have proven to be security flaws to be exploited; I'm assuming that 2-FA would be no different.

This forum is not short of malicious users, and anything that can be used to lock, access or block your access will be pushed to the limits.

In the context you describe, being tricked into logging into a fake site, this would not help either. You would simply use your 2-FA to log into their proxy, they would forward this input to the real forum and then be logged into your account just as easily.

T-FA is fine _{Theymos-Factor Authorization}