Add additional options for 2FA

[1337]

Hello,

Just a small suggestion that should be fairly easy to implement. I believe that U2f and Yubikey are both very important protocols and very easy ways to substantially increase user account security. There is already a xenforo extension made available to implement these, which can be found here: https://xenforo.com/community/resources/th-two-step-authentication-essentials.4987/.

Don't really see any downsides to this happening, but feel free to leave your opinions down below.

 

[1337]

What about an Authenticator app?

Authy is frequently used but also, as it depends primarily on SMS/phone # for verification, it is unsecure and can be exploited via SIM swap. If hardware keys like yubikey aren't an option, my personal recommendation is using something like https://bitwarden.com which is both a great PW manager and has very good built-in 2FA/TOTP support.

 

[jxhdvn]

Authy is frequently used but also, as it depends primarily on SMS/phone # for verification, it is unsecure and can be exploited via SIM swap. If hardware keys like yubikey aren't an option, my personal recommendation is using something like https://bitwarden.com which is both a great PW manager and has very good built-in 2FA/TOTP support.

I've been using the Authenticator app from Google and from what I can tell it doesn't require either of those. Is this a viable option

 

[1337]

I've been using the Authenticator app from Google and from what I can tell it doesn't require either of those. Is this a viable option

It's meh, no obvious downsides security wise but if you lose your phone you're kinda fucked. Make sure to keep a copy of those backup keys.

I'd still recommend switching to bitwarden/hardware if that's an option for you, but if you'd like to ask more in-depth, feel free to DM me on disc.

 

[jxhdvn]

It's meh, no obvious downsides security wise but if you lose your phone you're kinda fucked. Make sure to keep a copy of those backup keys.

I'd still recommend switching to bitwarden/hardware if that's an option for you, but if you'd like to ask more in-depth, feel free to DM me on disc.

Thanks for the tips

 

[Mick]

While accounts being compromised is a concern, introducing new methods of 2FA isn't going to prevent that from occurring. I don't think any user with 2FA enabled has ever had their accounts compromised since that would require a targeted attack against a single user which is significantly harder than password cracking.

If you're concerned about the security of your account then use google authenticator, it's perfectly secure and used by the staff team.

Denied, thanks for the suggestion.