2FA added

[Solosanz]

Wow another good improvement by PowerGlove, it seems epochtalk will likely to happen because we have him.

Honestly I was little shocked there's an OTP code when I want to login, I thought I visit the wrong site.

what actually the usage of that QR code and the address they have gave us?

Both are a same thing, you scan the QR code or input the setup key on your 2FA apps, the difference is you don't have to type each character if you scan the QR code.

[m2017]

When I saw OTP, I thought, “What kind of bullshit is this?” Only by hovering the cursor over these letters did I read the comment about 2FA.

It turns out that if the 2FA option is enabled, a code will be sent to your email to confirm login to your account? Did I understand everything correctly?

[TheUltraElite]

For a few seconds I was getting an April Fools Deja vu feeling when I saw that OTP field while logging in. I rechecked the date even if I was sure it was not 1st of April. 

So I checked the Meta section and lo and behold, our long requested feature is finally hear, thanks to theymos and PoweGlove for the early Christmas gift.

Got it enabled and I hope everyone else does the same too.

[Xal0lex]

When I saw OTP, I thought, “What kind of bullshit is this?” Only by hovering the cursor over these letters did I read the comment about 2FA.

It turns out that if the 2FA option is enabled, a code will be sent to your email to confirm login to your account? Did I understand everything correctly?

No, you will not receive a code in the mail. It has nothing to do with mail at all. To use 2FA you need to install the Google Authenticator application, scan the QR code that is present in your profile with the help of this application and when logging in to the forum enter the numbers that this application gives you.

[Cantsay]

At least I was still a part of the forum when some changes took place, the first I experienced was the addition of OP and now we have 2FA available for us.

Assuming a topic was created suggesting that 2FA should be added to the forum I would have boldly written that we are not going to see it soon cause theymos probably has other important things to attend to than that but surprisingly he came up with the this announcement.

I haven’t enabled mine but after I make this post I’m going straight to my settings to get it done.

[Sandra_hakeem]

Hopefully, the number of alts might drop if/when 2FA becomes mandatory. (And new users should have to employ 2FA automatically)

Can we have a shield to indicate we have 2FA enabled, please?
Kudos.

okay... I've been wondering how that would reduce the number of Alts? Hope I understood you clearly?... My bad, I haven't checked through the Google Authenticator to see how it works...

Could you explain how mandatory 2FA leads to less alts? After all, it's app-based 2FA.

that's exactly how confused I became when I first read his statement... Maybe timelord thinks the Authenticator could detect IPs to some point?

No, you will not receive a code in the mail. It has nothing to do with mail at all. To use 2FA you need to install the Google Authenticator application, scan the QR code that is present in your profile with the help of this application and when logging in to the forum enter the numbers that this application gives you.

Xal, is it safe to assume that this authentication process cannot be made to synchronize with just one device?.. cus scanning out the code on the app would definitely need two devices..

Sandra 🧑‍🦰

[Mpamaegbu]

Finally, it's implemented. Theymos, you surprised everyone (well, maybe me) on this with your quick response. Also, thanks to user PowerGlove.

~

Have I started to hear the complain now that 2fa code expires too quick 😂?

That's what makes us humans. We're insatiable by nature. If we don't complain, even when what's given seems the best, it simply makes life boring 😂

[joker_josue]

(...) the much-requested 2-factor authentication feature has finally been added.

(Thanks for letting me work on this, and for the valuable tweaks and additions that you made.)

Congratulations on the excellent work that was done!

Without a doubt, a reinforcement of the forum's security, and proof that this forum is still very much alive and that it deserves the trust of its users.

[dkbit98]

If you use the forgotten-password function, then there's an option to remove the 2FA. So 2FA does not provide any protection in case of a compromised email. Make sure that your email address is secure. If you don't want to set an email address, use something like yourUserName@invalid.bitcointalk.org; don't use a random nonsense email like y@x.com, since somebody might create that domain/email.

Adding additional 2FA for email address is also a good idea.
I noticed that whenever profile page is refreshed new shared secret and new QR code are generated, and that is good thing, but everyone make sure to backup everything correctly.

Let me know if there are any bugs.

Roger that.
Thanks for finally adding this feature

Thanks for all the congrats & stuff being left in this topic. Bitcointalk has become a lot more important to me than I expected when I joined. I'm grateful that I get to contribute to it in my own way, and I hope to keep doing that for a good while yet. Cheers!

We are waiting patiently for you next forum project

Xal, is it safe to assume that this authentication process cannot be made to synchronize with just one device?.. cus scanning out the code on the app would definitely need two devices..

It's so easy to bypass that by using web cam on the same device (laptop or computer) that has installed software for storing shared secrets.

[robelneo]

I have to change my password through my email just to get in again I've used the 2FA it shows

BAD 2FA Make sure the clock on your 2FA device is correct

I don't know why I'm getting this error as all the other sites I'm using show a correct 2FA

I followed this instruction, it says the authentication is already synched with Google servers

To make sure that you have the correct time:
Go to the main menu on the Google Authenticator app.
Select Settings.
Select Time correction for codes.
Select Sync now.

Am I the only one any help will be appreciated.

[wallet4bitcoin]

An applause worthy development. I have, on several cases imagined how to get my forum account secured and often wished for a 2fA integration and it just arrived promptly as expected.

However, I will await feedbacks from those who have used it and know which approach is best, talking about the emails, as stated by OP.

[Ultegra134]

Congratulations on the excellent work that's being done on this forum. It's extremely pleasant to see users' suggestions implemented; it's a way of showing appreciation towards us, who use this forum, that our voices have been taken into account. The 2FA was quite a common inquiry on the Meta board, and it's finally here. It's a vital security element, especially for higher-ranking members, to ensure the safety of our forum and prevent potential scam attempts.

I was always positive about the 2FA implementation, and now that it's finally here, I'm going to enable it as soon as possible.

[coupable]

I cannot describe my happiness at activating this additional layer of protection because I needed it for a long time before I was surprised that my account was stolen after the forum servers were hacked in 2015, and I was forced to remain for more than a year without an account since the account recovery system was not activated until later in 2018 if i can well remember.
Today, I feel that hope has returned to everyone by removing the fears of losing their accounts for one reason or another, since all requests to activate additional protection layers remained on the shelves on the basis that their activation will be in the new version of the forum, which does not seem to see the light of day soon.
In general, thanks to the forum administration for giving this point sufficient attention, and I hope that more work will be done to study and support many other good suggestions, if the launch of the new forum software will be delayed further.

[Peanutswar]

If you use the forgotten-password function, then there's an option to remove the 2FA. So 2FA does not provide any protection in case of a compromised email. Make sure that your email address is secure. If you don't want to set an email address, use something like yourUserName@invalid.bitcointalk.org; don't use a random nonsense email like y@x.com, since somebody might create that domain/email.

Adding additional 2FA for email address is also a good idea.
I noticed that whenever profile page is refreshed new shared secret and new QR code are generated, and that is good thing, but everyone make sure to backup everything correctly.

Im just wondering what if the user removes the 2FA unexpectedly on the device and how they will generate another QR again just to scan or even the code given so they can manually add it again to their device, after setting up that's the thought that comes up to my mind. Additionally, the Email feature is one of the most awaited added to the forum too.

[ImThour]

A much needed feature in 2023 when there are so many scams and phishing attempts going on, I appreciate this work from theymos and PowerGlove and will surely report any bug if I encounter.
I am sure with this, the account security will be way above the normal standards, 2FA is a great soluition.

[NotATether]

Long overdue. 2FA enabled, and there doesn't seem to be any problems with the implementation on my end.

You will get logged out if your password verification is not correct while editing the account settings though.

Hopefully, the number of alts might drop if/when 2FA becomes mandatory. (And new users should have to employ 2FA automatically)

This will not stop alt accounts at all since they can create many KeyPassXC login entries to store all the 2FA codes in.

[Timelord2067]

There's a URL on the icon in the 2FA - it leads to a parked domain advertisement.  Is this deliberate, or a blunder?


@Sandra_hakeem - no not IP addresses - phone numbers.

[AirtelBuzz]

When I saw OTP, I thought, “What kind of bullshit is this?” Only by hovering the cursor over these letters did I read the comment about 2FA.

It turns out that if the 2FA option is enabled, a code will be sent to your email to confirm login to your account? Did I understand everything correctly?

No, no code will be sent to the email. If you want to enable  2FA security system on your account, you will need Google Authenticator. As you have added your Binance and KuCoin Exchange to Google Authenticator, you will see Secret (base32)I have covered with red mark and copy and add it to your Google Authenticator. Still, while logging in, copy and paste the OTP from Google Authenticator and login.





Helps and Beginner threads have a post about 2FA. If you see this post I think you will understand very easily
= https://bitcointalk.org/index.php?topic=5479003.0

[DYING_S0UL]

An applause worthy development. I have, on several cases imagined how to get my forum account secured and often wished for a 2fA integration and it just arrived promptly as expected.

However, I will await feedbacks from those who have used it and know which approach is best, talking about the emails, as stated by OP.

Give it a try. I have enabled 2FA and it worked without any issues. And about getting the code through email, I think it doesn't matter much. Besides I have been using google Authenticator and Authy for years, never encountered any bugs or sync issue. Also you can backup your keys set passwords. So it's pretty secure and protected.

[HONDACD125]

Thanks for bringing additional security layer to the this forum. I was thinking from the start that 2FA feature should be available high rank accounts are most worthy and hacker have advance tool to hack common passwords.

I will try later to add 2fa later and I hope i will not face any problem. I am using real gmail already opened in my mobile with full access. If i lost 2fa ,i hope my email will be enough to recover it