YubiKey optional Bitcointalk login

[dkbit98]

How hard would be to add Yubikey as optional two-factor authentication login for Bitcointalk forum?
Like I said it would be only optional and people would have to agree to lose access for their account in case they lost backup.

Many members have Yubikeys or hardware wallets like ledger or trezor that can work the same as hardware security and additional protection for our accounts.
Forum hacks are getting more serious and scary like this latest example of Top Three Russian Cybercrime Forums Hacked, and I know there are few ex forum members who are repeatedly getting banned, that are non-stop thinking of different ways how to hack the forum or bring it down.

I am not sure if this could be implemented now or for new forum software (that is long overdue) but I don't see any downsides for doing that.
Maybe something like this:

[The Cryptovator]

I am not familiar with Yubikey, just a little search on Google and discover that you need a hardware device to use Yubikey. I don't think it's easy for users at all. In case of device lost or key lost will lead your account not accessible and would quite a lengthy process to recover your account by the forum administration. I know it would more secure from Google 2FA but almost isn't the same? Theme is same, lost key means lost account unless admin recover by themselves. Doesn't matter it's optional, some users obviously will attempt to use it and perhaps we will see many threads about account block.

[Charles-Tim]

I know it would more secure from Google 2FA but almost isn't the same?

Yes, it is a hardware authenticator that was manufacturer by Yobico, but I do not see it useful than software ones. Some people even having the knowledge to use online 2FA on another device which is what experienced people will do. What that should be requested for is the use of 2FA to access our Bitcointalk account and of which there are some threads about that, I believe if admin will make this reality, software 2FA will first be introduced which I believe is perfect enough for experienced users. What matter most is the knowledge needed to use it, as for me, I prefer the software ones which I already have on another mobile device rather than wasting money on what can be achievable on my other device. Software authenticators can even work without connecting devices online. But, all are recommendable, while knowledge to further still protect account is very important.

[Heisenberg_Hunter]

I remember Yubikeys from the infamous Mt Gox theft  I think Mt Gox offered free Yubikeys for traders who had a certain amount of volume to provide the best possible security for its customers and still failed to do so! For a forum which handles so much of bitcoins in trades, I think it is indeed necessary to provide some sort of 2FA security for the forum users since the account name and the reputation is quite important over here. It is generally better to log out of the forum and re-login while using it for the next session but not many would be following it due to the laziness of entering our passwords manually again and again, but this should be a necessity if we are using various devices for accessing the forum.

I frequently use and own a hardware token (unwilling to post the brand or name of it) for a laptop and I believe it serves to be one of the best security practices for securing confidential information physically from people nearby. But the major downfall of using a hardware token is that if it's lost, we would most probably be losing the access to our accounts. I have experienced certain bizarre circumstances where people still lose their hardware tokens provided knowing how important they are. Hence handling them while we are away from home should be of utmost care. But truly speaking, a simple 2FA implementation would suffice and will be seen as a good welcoming change with the decrease of hacks in future!

[pugman]

Man I would love for a yubikey login. Any login with 2fa. But that is apparently very hard/annoying to code in SMF as this forum is too customized to fit its needs. Now I do not to what length the forum has been customized, but that is the sole reason why there ain't no 2FA yet.

However, the new forum is said to 2FA and other security measures. But when is it coming? Well.

[zasad@]

Why make additional complications for users?
Security is important for forum administration accounts. All other users will be able to use the recovery services.
Some users are reading the forum on a mobile phone, how will your idea work on mobile phones?
Very funny information from the article about cybercriminals that cybercriminals use ICQ

[Husna QA]

Some users are reading the forum on a mobile phone, how will your idea work on mobile phones? -snip-

Maybe you haven't seen the following information:

Newest addition to the YubiKey 5 Series, with a future-proofed, multi-protocol key
-snip-
- Enables secure web and mobile app login across all major operating systems such as iOS, Android, Windows 10, and Linux, and across all major browsers

I am not sure if implementing the login option using 2fa, such as using Yubikey, can be realized in the current forum. Refer to the forum administrator's statement below:

That wouldn't eliminate the need for manual recoveries; it might even increase it as people lose their second factor. 2FA would be nice, but IMO the email notifications provide many of the same benefits, so it's not high on my to-do list.

[dkbit98]

Why make additional complications for users?

It's not complicated at all and you don't have to use it if you don't want.
Yubikey is used by Kraken, Binance, Gemini, and other exchanges, as well as all password managers, cold storage, governments, Tesla, Skrill and many others:
https://www.yubico.com/works-with-yubikey/catalog/

I am not sure if implementing the login option using 2fa, such as using Yubikey, can be realized in the current forum. Refer to the forum administrator's statement below:

He did say it would be nice to have this option, and it still is on his to-do list, just not so high.
So he is not against it.

[hugeblack]

What is the added value that forum accounts give? Unlike signature campaigns, there is no difference between a newbie or a legendary account.
Buying and selling things is done through brokers or trusted members who often sign a letter from a specific address.
It is also easy to recover hacked accounts>

[OgNasty]

Bitcoin doesn't need 2fa to safeguard nearly a trillion dollars worth of wealth.  I don't think this forum needs it to safeguard accounts.  As long as users were willing to accept their account is lost forever if their 2fa access is lost I don't see a downside to it from a security standpoint.  Not adding something like this seems like it is saving the administration from a lot of headaches and protecting a lot of users from themselves.  Hard to argue it wouldn't protect against account hacks, but it would introduce a new problem.

[Pmalek]

I don't think major improvements will be made on this SMF-based forum. The admins will probably fix serious issues or bugs (if discovered), but new features will be rolled out only with the release of the new forum software.

hilariousandco confirmed several years ago that 2FA will become a reality one day. Various types of authentification will be possible then.

It's coming with the new forum:

https://bitcointalk.org/index.php?topic=523070.0

In addition to normal password authentication, the forum should support various kinds of of alternative authentication. At least password auth, email verification, secret questions, OpenID, PGP, OpenVPN (automatic creation of subnets + IP source verification), and Bitcoin address signing should be supported, with multiple allowable credentials for each auth type. Users should have the option of requiring any combination of these auth types. Like "pgp OR (password AND OpenID)". And users should be able to require that changes to some or all auth types as well as the required combination of types not take effect for some configurable number of days. This allows for different types of recovery methods.

Also, it should be possible to limit the access for each auth type. So one type might be able to only read, but not post, etc. If the Web interface uses the same API that is exposed publicly, then these permissions can be in the form of allowed API commands.

     

[FIFA worldcup]

I know it would more secure from Google 2FA but almost isn't the same?

Yes, it is a hardware authenticator that was manufacturer by Yobico, but I do not see it useful than software ones. 

Why do we need a hardware 2fa authenticator for all the users who want to use the forum ? Many will simply leave the forum because they don't want to buy the hardware wallet. Consider that you are a company who want to post your ANN here or a person advertising their service and you need to buy a hardware authenticator in the first place ?

[Charles-Tim]

Why do we need a hardware 2fa authenticator for all the users who want to use the forum ? Many will simply leave the forum because they don't want to buy the hardware wallet. Consider that you are a company who want to post your ANN here or a person advertising their service and you need to buy a hardware authenticator in the first place ?

It will be optional, not necessary, also if the 2fa is software ones like google and andOTP, it will also be optional. So, if you do not want to use it, you will not enable it because it will most likely be disabled by dafault.

[JohnBitCo]

Why do we need a hardware 2fa authenticator for all the users who want to use the forum ? Many will simply leave the forum because they don't want to buy the hardware wallet. Consider that you are a company who want to post your ANN here or a person advertising their service and you need to buy a hardware authenticator in the first place ?

It will be optional, not necessary, also if the 2fa is software ones like google and andOTP, it will also be optional. So, if you do not want to use it, you will not enable it because it will most likely be disabled by dafault.

I suppose its just a suggestion to use 2fa and whether it will be YubiKey or google authenticator it will depend what theymos decides. Also it will be up to him to make it compulsory or not. When many of the sites uses the 2fa authenticator and it is still not implemented by theymos on this forum, there must be a reason for that.

[Evilish]

Why YubiKey and why not the more popular alternative Google Authenticator? Many of us don't wanna deal with carrying a physical device just to be able to log in to a forum, that would be an overkill.

Most people have access to Google Auth and it would make more sense to go with that if 2FA was to ever be added to Bitcointalk.

I made a suggestion to add 2FA/MFA of some sort recently and I think the conclusion was it's planned in the next version of forum software.

Better to just wait and watch.

[posi]

Hard to argue it wouldn't protect against account hacks, but it would introduce a new problem.

Life is hard
Crypto mining is hard cause it introduced another problem but solve many
Crypto trading is hard
Almost every good thing in this life is hard but we just need to find a way to deal with the difficulties cause nothing good comes easy.
If Yubikey protects against phishing, some online impersonator email sender and provide security why do you believe won't protect against account hack?

[Oshosondy]

I think there are many members on this forum, ranked members since long time ago and yet their account not hacked, people that are fearing can pm them to help on how to safeguard their accounts. If you follow the precaution and safety measures, your bitcointalk account will not be hacked. I believe admin would have looked into this issue and see this not needed. Instead, enable 2fa on your email, check the IP log of your bitcointalk account daily before you post, make sure you stake your address already for evidence in case of hacked account. With this I think you have nothing to be worried about, also use a very strong password, not 123 or abc password.

[JohnBitCo]

Hard to argue it wouldn't protect against account hacks, but it would introduce a new problem.

Life is hard
Crypto mining is hard cause it introduced another problem but solve many
Crypto trading is hard
Almost every good thing in this life is hard but we just need to find a way to deal with the difficulties cause nothing good comes easy.
If Yubikey protects against phishing, some online impersonator email sender and provide security why do you believe won't protect against account hack?

There is no solution which can give you 100% grantee that your account will not be hacked by using a hardware or software 2fa. Many times we have seen people get lose of their accounts by themselves by not losing the 2fa and the backup key also. These authenticators are good for safe guard but we have to first take all the precautions ourselves also.

[posi]

Life is hard
Crypto mining is hard cause it introduced another problem but solve many
Crypto trading is hard
Almost every good thing in this life is hard but we just need to find a way to deal with the difficulties cause nothing good comes easy.
If Yubikey protects against phishing, some online impersonator email sender and provide security why do you believe won't protect against account hack?

There is no solution which can give you 100% grantee that your account will not be hacked by using a hardware or software 2fa. Many times we have seen people get lose of their accounts by themselves by not losing the 2fa and the backup key also. These authenticators are good for safe guard but we have to first take all the precautions ourselves also.

I agreed nothing is ever secure when it comes to the internet but all this online security apparatus still secure people account if avoid contagious human mistakes which may give online attackers the chance to hacked the security device but this is once a mistake made by Murat when he lost his holding.

[UserU]

Why YubiKey and why not the more popular alternative Google Authenticator? Many of us don't wanna deal with carrying a physical device just to be able to log in to a forum, that would be an overkill.

Most people have access to Google Auth and it would make more sense to go with that if 2FA was to ever be added to Bitcointalk.

I made a suggestion to add 2FA/MFA of some sort recently and I think the conclusion was it's planned in the next version of forum software.

Better to just wait and watch.

Exactly my thoughts. 2FA software is good enough, and those hardware stuffs are best reserved for those FI-related industry jobs.