Force two factor auth on all accounts

So today I got an email telling me someone across the ocean managed to get their filthy hands on my password.

Thankfully I had two factor authentication enabled so they didn't get my account compromised. Had I not enabled it in the past I would've lost my account by now.

That made me think, with all the transactions made in here, why is two factor an opt-in and not a requirement? Wouldn't it be better for everyone to have two factor as a requirement?

So no one's interested?

Security often comes at the cost of privacy & convenience.

In this case, forcing it may make someone give up a phone number or download an app that they don't want to.

Making it a requirement introduces a barrier to the potential customer (user).

Most (maybe unfortunately) just want to use the app (for entertainment).

They don't care about security.

So creating this barrier is unnecessary to them and an inconvenience.

There's potentially lost customers (users) due to challenges with user experience.

Think from their point of view.

(Also, very inconvenient for bot users which accounts for a significant portion of the userbase lmao)

I was about to lose my account 2 weeks ago .. and now i have enabled the two factor auth .. it is much better and much safer .. at least if anyone tried to get into my account he must get into my email then to my mobile phone first !

bmanfacts said:

Security often comes at the cost of privacy & convenience.

In this case, forcing it may make someone give up a phone number or download an app that they don't want to.

Making it a requirement introduces a barrier to the potential customer (user).

Most (maybe unfortunately) just want to use the app (for entertainment).

They don't care about security.

So creating this barrier is unnecessary to them and an inconvenience.

There's potentially lost customers (users) due to challenges with user experience.

Think from their point of view.

(Also, very inconvenient for bot users which accounts for a significant portion of the userbase lmao)

Click to expand...

Yeah, If a phone number was required it'd be an overkill... But there's the option to have 2-factor with your email address, and an email address is required to register on BHW, so there is technically no barrier for new users.

We can't really enforce 2fa across the board on the forum at the moment - even Facebook and Google don't make 2fa a requirement on their accounts and we need to make sure we don't discourage new members from engaging by making the barrier to entry too complicated.

We do, however, strongly encourage all members to enable it - details available here: https://www.blackhatworld.com/seo/important-account-security.879700/

We're also reviewing security features available in the planned forum upgrade later this year, for example, we're looking at sending user notifications if their account has been accessed from another location or there's been suspicious activity. There'll be more updates on these features closer to the upgrade date.