Quote from: Evilish on December 27, 2020, 06:28:36 PM

Is there any reason why Bitcointalk still doesn't have support for users enabling 2FA/MFA (two factor authentication / multi factor authentication)? I have seen many Bitcointalk accounts getting compromised over the years and those accounts are then used for malicious activities. I believe a lot of that could be avoided if Bitcointalk added support for members to add an additional factor of authentication in from of Google Authenticator or some other way.

It will be good if Bitcointalk forum can be 2fa supported which can increase the security level of account not to be compromised, but specifically more referring to people that are not careful enough at one point that led to their account being compromised. But, if 2fa is enabled, it can only increase the security level, not that their are no malware or ways that can reveal the codeto attackers. Although, revealing 2fa code to attackers may not be common but possible. Which means there should still always be a great carefulness in protecting our account.

For members that are careful enough, there are ways of protecting our Bitcointalk account yet without 2fa, although implementing 2fa will make the security stronger. First, it is good to always keep checking our IP address used to access this forum. If another person login or access your account with another IP address, this can be known quickly and be reported. Also, it is very good to hide our email on the forum, it is usually hidden by default but some members make the mistake of not hiding it. Also, protecting the email we use is very important.

Lastly, about multifactor authentication, I do not think that is needed. Let us take these three as an example of multifactor authentication:

1. Password or pin, this forum already has login that will require users to login using a password
2. 2fa
3. Biometry like finger print, which I do not really see useful.

It will be good if 2fa is implemented as users login option on this forum which can increase the security level, especially for careless people. But, for people that are careful enough, accounts can remain not compromised, but checking the IP addresses login will be good, especially for knowing early attack attempt and reporting before it is too late.