2 step verification required?

[Reversi]

Even if you use decent security practices, that definitely doesn't mean others do. The average person's security practices are laughable at best.

So it should be optional to have 2 step verification. It is that users vault if their account is hacked. It definitely should not be mc-markets problem nor a problem we have to deal with.

If their account gets compromised and banned, they can only blame themselves for being hacked. Just because some idiots with the password 123456789 got hacked, why the hell should everyone on mcm need to check their email to log in.

 

[mattrick]

So it should be optional to have 2 step verification. It is that users vault if their account is hacked. It definitely should not be mc-markets problem nor a problem we have to deal with.

If their account gets compromised and banned, they can only blame themselves for being hacked. Just because some idiots with the password 123456789 got hacked, why the hell should everyone on mcm need to check their email to log in.

Staff have to deal with those who have had their accounts compromised. Is it seriously that big of an inconvenience to click on an email link or enter a code every 30 days? It takes 10 seconds. Like I said, while your security practices may be somewhat sound, that definitely doesn't guarantee others are. By forcing 2FA across all users, it makes every account significantly more difficult to get in to, thus reducing the amount of time staff have to spend helping those recover their accounts.

 

[Reversi]

Staff have to deal with those who have had their accounts compromised. Is it seriously that big of an inconvenience to click on an email link or enter a code every 30 days? It takes 10 seconds. Like I said, while your security practices may be somewhat sound, that definitely doesn't guarantee others are. By forcing 2FA across all users, it makes every account significantly more difficult to get in to, thus reducing the amount of time staff have to spend helping those recover their accounts.

Lol, 10 seconds is still 10 seconds. If you log on 6 times a day, you just lost a minute. 1 Week, you just lost 7 minutes, the year? You lost 364 minutes = 6 hours just checking your email. Even more if you are not constantly logged on to your email or you have multiple emails logged on so you need to switch between.

 

[mattrick]

Lol, 10 seconds is still 10 seconds. If you log on 6 times a day, you just lost a minute. 1 Week, you just lost 7 minutes, the year? You lost 364 minutes = 6 hours just checking your email. Even more if you are not constantly logged on to your email or you have multiple emails logged on so you need to switch between.

Like MetalMonkey said, you can trust your device for 30 days. Also consider that having you account hacked will be much more inconvenient than entering a code every 30 days.

 

[Reversi]

Like MetalMonkey said, you can trust your device for 30 days. Also consider that having you account hacked will be much more inconvenient than entering a code every 30 days.

Not at all. Considering the fact that I have to fucking type in a legitimate password that doesn't start and end with 1 and 9, I seriously doubt anyone would bother hacking me or most of the users on mcm.

Wasting hours of my life checking my email to log in would be much of an inconvenience. Like the 90% of the users that replied to this thread, its a complete waste of time for the rest of mcm to have to check their emails due to some idiots with simplistic passwords.

Also what if you don't always use the same device to log into mcm, its still an inconvenience maybe even more so if your on a phone or tablet.

 

[mattrick]

Not at all. Considering the fact that I have to fucking type in a legitimate password that doesn't start and end with 1 and 9, I seriously doubt anyone would bother hacking me or most of the users on mcm.

Wasting hours of my life checking my email to log in would be much of an inconvenience. Like the 90% of the users that replied to this thread, its a complete waste of time for the rest of mcm to have to check their emails due to some idiots with simplistic passwords.

Also what if you don't always use the same device to log into mcm, its still an inconvenience maybe even more so if your on a phone or tablet.

Having a simple password definitely isn't the biggest issue; its reusing your password across multiple sites. Like I said, many leaks have gone public recently with plain text passwords. Any kid could just download the link and Ctrl+F for your email or username. 2FA pretty much makes this completely preventable. Check out https://haveibeenpwned.com and enter your email or username so you can see which (public) leaks you have been a part of.

If your account were to be hacked, you aren't just wasting your own time, but the staff team's time as well. I doubt you will be wasting hours of your life checking your email; if you check every 30 days and assuming it takes 10 seconds to check your email, you would spend a little over a minute of your time a year. Unless you intend to spend a bit less than 60 years on Minecraft Market, you won't spend even an hour checking 2FA.

I still fail to see how this is such a big inconvenience that you could justify wasting your and the staff's time.

 

[Reversi]

Having a simple password definitely isn't the biggest issue; its reusing your password across multiple sites. Like I said, many leaks have gone public recently with plain text passwords. Any kid could just download the link and Ctrl+F for your email or username. 2FA pretty much makes this completely preventable. Check out https://haveibeenpwned.com and enter your email or username so you can see which (public) leaks you have been a part of.

If your account were to be hacked, you aren't just wasting your own time, but the staff team's time as well. I doubt you will be wasting hours of your life checking your email; if you check every 30 days and assuming it takes 10 seconds to check your email, you would spend a little over a minute of your time a year. Unless you intend to spend a bit less than 60 years on Minecraft Market, you won't spend even an hour checking 2FA.

I still fail to see how this is such a big inconvenience that you could justify wasting your and the staff's time.

LOL, your post makes absolutely no sense. Do you honestly think that a few seconds a day adds up to 10 seconds a month. I'm sorry but just no.

Look, this required 2FA is just a massive pain in the ass for everyone and the last time this was implemented it got hate as well. Even BeBosny said this was temporary when this was enabled to try to reduce the amount of annoyed people, which there are still a ton of.

Having a simple password definitely isn't the biggest issue; its reusing your password across multiple sites. Like I said, many leaks have gone public recently with plain text passwords. Any kid could just download the link and Ctrl+F for your email or username.

I would also suggest reading my reply before making another reply and wasting my time repeating the exact same thing to you. I said avoid using simple passwords and launching random programs. I mean it is very rare that an actual hacker with malicious intentions will target your accounts and use other means than password cracking or rats to get in. I guarantee that most of these compromised accounts available publicly have been stolen for the 2 reasons stated above.

if you check every 30 days and assuming it takes 10 seconds to check your email, you would spend a little over a minute of your time a year.

Assuming that I check log onto mc-market only 1 time a day with a time average of 10 seconds a day, I would be wasting 300 seconds a month, or 3650 seconds a year. Now 3600 seconds is equivalent to an hour. I'm spending an hour copying and pasting codes to log on to mcm, and thats if it's only once a day. I log in 3 times a day so apparently I will waste 3 hours of my future life copying and pasting random codes to log in.

Who logs into mc-market once a month??? Seriously, what would they even be doing on mc-market to log in once a month.

Now lets say this applies to 1,000 mcm users who haven't enabled trust this device since their traveling, moving, whatever. Lets say they all log in once a day. In 1 year, thats 1,000 hours wasted around 1,000 users.

Legit, the amount of 2FA threads and posts on mc-market... If you would read my original post, I'm asking whether or not it became required for everyone or just me. I do not understand how you can justify this giant waste of time known as 2FA. Now rather then trying to defend a temporary security practice put in place which even the staff are burdened by, please refrain from responding to this since you seem more like your looking for a fight rather then providing any valid points.

 

[mattrick]

LOL, your post makes absolutely no sense. Do you honestly think that a few seconds a day adds up to 10 seconds a month. I'm sorry but just no.

If you check the "Trust this device for 30 days" option, yes it adds up to 10 seconds a month.

I would also suggest reading my reply before making another reply and wasting my time repeating the exact same thing to you. I said avoid using simple passwords and launching random programs. I mean it is very rare that an actual hacker with malicious intentions will target your accounts and use other means than password cracking or rats to get in. I guarantee that most of these compromised accounts available publicly have been stolen for the 2 reasons stated above.

Using complicated passwords and not running shady programs won't help you if you are involved in a password leak. You don't understand how ridiculously easy it is to get your hands on a password leak; much easier than trying to install a RAT on someone else's computer or bruteforcing their password.

Assuming that I check log onto mc-market only 1 time a day with a time average of 10 seconds a day, I would be wasting 300 seconds a month, or 3650 seconds a year. Now 3600 seconds is equivalent to an hour. I'm spending an hour copying and pasting codes to log on to mcm, and thats if it's only once a day. I log in 3 times a day so apparently I will waste 3 hours of my future life copying and pasting random codes to log in.

Who logs into mc-market once a month??? Seriously, what would they even be doing on mc-market to log in once a month.

Now lets say this applies to 1,000 mcm users who haven't enabled trust this device since their traveling, moving, whatever. Lets say they all log in once a day. In 1 year, thats 1,000 hours wasted around 1,000 users.

Legit, the amount of 2FA threads and posts on mc-market... If you would read my original post, I'm asking whether or not it became required for everyone or just me. I do not understand how you can justify this giant waste of time known as 2FA. Now rather then trying to defend a temporary security practice put in place which even the staff are burdened by, please refrain from responding to this since you seem more like your looking for a fight rather then providing any valid points.

You don't know what you're talking about. When logging in using 2FA there's an option to trust a device for 30 days. Here, I'll show you:

 

[Reversi]

If you check the "Trust this device for 30 days" option, yes it adds up to 10 seconds a month.


Using complicated passwords and not running shady programs won't help you if you are involved in a password leak. You don't understand how ridiculously easy it is to get your hands on a password leak; much easier than trying to install a RAT on someone else's computer or bruteforcing their password.


You don't know what you're talking about. When logging in using 2FA there's an option to trust a device for 30 days. Here, I'll show you:

Apparently you don't read much. I clearly stated I'm not interested in arguing with you AND told you not to respond.

Hopefully this rainbow colored bolded quote from me thats IN YOUR OWN response helps you read.

Now lets say this applies to 1,000 mcm users who haven't enabled trust this device since their traveling, moving, whatever. Lets say they all log in once a day. In 1 year, thats 1,000 hours wasted around 1,000 users.

You even quoted my post then tried to tell me "apparently you don't know this option exists when its written right there, in your response. I state that out of the entire mcm community assuming that 1,000 do not want to enable trust this device, wastes time checking their mails to log in once a day it would total up to 1,000 hours. You then tell me I must not know enabling trust this device exists. WTF? I went over it, and your trying to argue that I don't know it exists.

It is now clear then ever that you are nothing more then a thread trasher. You don't bother reading responses written to you and make responses just to promote arguing. Ignored.

 

[mattrick]

Apparently you don't read much. I clearly stated I'm not interested in arguing with you AND told you not to respond.

Hopefully this rainbow colored bolded quote from me thats IN YOUR OWN response helps you read.

Okay, so you are defending your argument by saying "you are not allowed to post a rebuttal". That sounds like a completely fair way to debate. Either way, I intend to continue to respond in order to clear up the obvious misconceptions everyone has about 2FA since you are decrying it for no valid reason.

I state that out of the entire mcm community assuming that 1,000 do not want to enable trust this device, wastes time checking their mails to log in once a day it would total up to 1,000 hours.

So you are saying that you, who is complaining about having to complete 2FA every day or so, are refusing to use the option to allow you to complete 2FA every month instead? I can only see a masochist doing that. Could you please explain to me why on earth anyone would decide not to use that option? Since you mentioned traveling people, 2FA validation is based on browser cookies, not IP address. So even if you move across the world, if you are using the same device, you still don't have to complete it. I also seriously doubt that you are traveling every day. Also, the geolocation based protection strategy you promoted is flawed. Any member in the same country can access your account and if you are traveling, well that completely contradicts your argument (not to mention that geoip isn't always accurate). Yes, I am aware you can disable it, but this defeats the point.

It is now clear then ever that you are nothing more then a thread trasher. You don't bother reading responses written to you and make responses just to promote arguing. Ignored.

My intention isn't to promote arguing, but when you throw personal insults at the person trying to rebut your point, it makes it seem like more of an argument than a friendly debate.

 

[Reversi]

Okay, so you are defending your argument by saying "you are not allowed to post a rebuttal". That sounds like a completely fair way to debate. Either way, I intend to continue to respond in order to clear up the obvious misconceptions everyone has about 2FA since you are decrying it for no valid reason.

Sorry reported. Seems to think mc-market is a place to debate and argue about opinions rather then a marketplace for offering and requesting various services.

Rules:
1.4 Do not defame or otherwise trash another member, person, or thread.
1.5 Do not disrespect, harass, hate on, or troll another member or person.
1.8 Do not post content that is meaningless or extremely low in quality. Content that might be considered meaningless includes, but is not limited to, posts that contain comments that aren’t related to the discussion topic of a thread and posts that only consist of one or two words.

So you are saying that you, who is complaining about having to complete 2FA every day or so, are refusing to use the option to allow you to complete 2FA every month instead? I can only see a masochist doing that. Could you please explain to me why on earth anyone would decide not to use that option? Since you mentioned traveling people, 2FA validation is based on browser cookies, not IP address. So even if you move across the world, if you are using the same device, you still don't have to complete it. I also seriously doubt that you are traveling every day. Also, the geolocation based protection strategy you promoted is flawed. Any member in the same country can access your account and if you are traveling, well that completely contradicts your argument (not to mention that geoip isn't always accurate). Yes, I am aware you can disable it, but this defeats the point.

Geolocation based protection stradegy I promoted. Ok, last time you claimed I didn't know anything, now your claiming I'm promoting random things I guarantee you just pulled out of your ass. Traveling every day and traveling to another place once every 30 days are 2 entirely different things. You are 100% off topic now and are just here to argue and thread trash. Just leave, nobody needs you to promote off-topic arguements and meaningless hate.

My intention isn't to promote arguing, but when you throw personal insults at the person trying to rebut your point, it makes it seem like more of an argument than a friendly debate.

Please direct me to where I am throwing personal insults. I swear, make comparisons, but I don't believe I threw any personal insults. Even if I did throw any personal insults, its due to the fact that you are relentlessly trying to trash my thread with your own opinion.

Again, seems to think that either mcm is a debating site, or that my threads topic is debating the use of the 2FA system which will be removed soon anyways. The topic is "Is it required for everyone or just me?" since I did not know whether I mistakenly enabled it or if it was enabled for all users cause the site administrators decided that. The topic has been closed, all you are doing is thread-trashing, and promoting off-topic conversations. I'm asking you to leave the thread since the topic "a question" has been answered and solved.

Claims he is trying to "rebut my point" except the fact that my point was a question I needed answered. I got my answer. I do not remember asking for thread-trashers to come attack my thread asking a question.

 

[mattrick]

Sorry reported. Seems to think mc-market is a place to debate and argue about opinions rather then a marketplace for offering and requesting various services.

Rules:
1.4 Do not defame or otherwise trash another member, person, or thread.
1.5 Do not disrespect, harass, hate on, or troll another member or person.
1.8 Do not post content that is meaningless or extremely low in quality. Content that might be considered meaningless includes, but is not limited to, posts that contain comments that aren’t related to the discussion topic of a thread and posts that only consist of one or two words.

I guess forcing your own opinion is fine, though.

Geolocation based protection stradegy I promoted. Ok, last time you claimed I didn't know anything, now your claiming I'm promoting random things I guarantee you just pulled out of your ass.

Okay, maybe not promoted, but you definitely seemed to prefer geolocation-based security over 2FA.

Traveling every day and traveling to another place once every 30 days are 2 entirely different things.

Like I said, xenforo 2FA is cookie-based, so you should have absolutely no issue when moving, no matter how often it is.

Please direct me to where I am throwing personal insults. I swear, make comparisons, but I don't believe I threw any personal insults. Even if I did throw any personal insults, its due to the fact that you are relentlessly trying to trash my thread with your own opinion.

It is now clear then ever that you are nothing more then a thread trasher.

You are 100% off topic now and are just here to argue and thread trash. Just leave, nobody needs you to promote off-topic arguements and meaningless hate.

I'm not in any way trying to trash your thread. You are promoting poor security practices based on misconceptions, I am just trying to correct those misconceptions. I am explaining why 2FA is enabled for everyone.

Claims he is trying to "rebut my point" except the fact that my point was a question I needed answered. I got my answer. I do not remember asking for thread-trashers to come attack my thread asking a question.

If I wanted to "attack" your thread, I would not be commenting about 2FA. I have absolutely no reason to attack you or your thread. If you consider this off topic, I think you should revaluate your definition of the word. I wasn't the first person to bring up this subject, but you only seem to be attacking me for it.

 

[Ivain]

The only reason 2FA is currently required is as a buffer against possible security issues of accounts with crappy passwords, as a lot of those kept getting compromised, and it was a pain for staff to deal with each time. Period.
There are definitely no plans to make required 2FA permanent, it's simply there until better security measures have been implemented. That's all there is to say on the matter.

 

[mattrick]

The only reason 2FA is currently required is as a buffer against possible security issues of accounts with crappy passwords, as a lot of those kept getting compromised, and it was a pain for staff to deal with each time. Period.
There are definitely no plans to make required 2FA permanent, it's simply there until better security measures have been implemented. That's all there is to say on the matter.

I know many people will complain about it, but have you considered a forced password reset? There's been a number of sites which have done it as a result of the recent leaks.

 

[Ivain]

I know many people will complain about it, but have you considered a forced password reset? There's been a number of sites which have done it as a result of the recent leaks.

Not useful if there's people that are gonna set their password to 12344321 and similar low level crap.
It's up to bebos to decide when to remove it.
Until then, all you need to do is go through 2FA once on each device you use, and set it to 'trust this device for 30 days'
problem solved. It's unlikely you'll need to use it again, as I expect it to not be forced anymore 30 days from now

 

[Reversi]

Not useful if there's people that are gonna set their password to 12344321 and similar low level crap.
It's up to bebos to decide when to remove it.
Until then, all you need to do is go through 2FA once on each device you use, and set it to 'trust this device for 30 days'
problem solved. It's unlikely you'll need to use it again, as I expect it to not be forced anymore 30 days from now

Yeah, im traveling so I'm borrowing a computer, (hate laptops), don't want to enable 2fa on someone elses computer lol.

 

[Ivain]

Well, that's a specific problem then.