Protect your account with two-factor authentication!

Can we get a "remember this device" feature? It's annoying having to whip our my phone every time I log in on my work computer.

Was 123456 your one-time-password? That's so lucky.

Heaven forbid my listnook account is hacked and posts some thing positive about thief scam artist Johann Gevers.

Can we get some protection against bots?

Can you start working on three-factor authentication?

Feedback! After I enabled 2FA. I was able to disable it whilst being still logged into my account, but without being prompted for a 2FA code or generated backup code. I checked using Incognito mode, logging in cleanly, and I was still able to disable it without requiring a 2FA code. So before if a co-worker/spouse/friend jumped my computer they already weren't able to change my Listnook password without me having the option of resetting it to my email, but now they can click 2 buttons to enable 2FA and I get locked out of my own account with no method of recourse to get it back. -_- This isn't a good design, especially with a "log me out from everywhere button". I don't want to scope creep the project, but that seems like it should be within reasonable security scope/threat model. But I do understand the trade off, people losing their phones and such. So I would think the solution may be best left up to the user. An SMS notification perhaps, but people's number may change when they lose their phone anyway too. SMS is not secure, but anyone who knows that would be using a seperate option which would be a default unchecked checkbox which says "I agree that I must provide a 2FA code, or a backup code, to deactivate 2FA OR THIS SETTING"? Also, having to prompt for a 2FA code to get my backup codes would be good. So someone can't come along and have a list of 10 secret codes to use against me later down the line if they figure out my password/email account details, and at that time they wouldn't need to compromise my phone at the same time. Pretty UI stuff: On the Enable Two-Factor setup screen, you have to click "Enter the key manually" to get the image back, that text should update. Secondly. When you login, the button to submit your 2FA code says "Check code", I would suggest it should just be "Submit". That's a blur of the lines between implementation (which is literally checking the code), and usage(which is someone using it is going to legitimately be just submitting you the code they have). If I haven't been clear, feel free to ask for clarification.

I think it would be nice to have a backup, like the possibility to use a U2F hardware token, to use instead of your phone. This way it could be more secure/reliant and it's way easier to just use a token instead of a authenticator app.

why? almost all of my listnook accounts have been to talk shit to strangers when they disagree with me.

Be careful when using Google auth. If your phone suddenly breaks, you're sol.

I ask every time you guys talk about 2FA, are you planning on supporting physical U2F tokens like Yubikeys? I prefer that to Auth apps Edit: i missed part of my thought in my original comment

My password’s so good that I don’t even know it.

What about u2f and/or "classic" yubico OTP? Having to enter a 6 digit number by hand is a serious nuisance for me. Hardware token is much less friction.

If someone is seriously gonna waste their time hacking my dumb account they can keep it tbh

I’m suppose to trust Stringer Bell? Is Clay Davis in on this too?

So glad that this is being released to everyone. It's worked very well for me since beta. Pro tip: If you use any script / bot to login with a 2FA'd account, or you don't get prompted for the 2 factor code then in the password field just do `YourPassword:2FactorCode`, ex: `Hunter2:123456`. If you use RES and the Account Switcher, it has support as well if you click the 2FA toggle then it will ask you for the code when you switch accounts.

Thank you so much for adding 2FA! I've been using it for around a month and I've had no issues with it. :)

What about u2f Security keys

Here's another vote for U2F?

Damn Hunter2 isn't going to work anymore.

If someone wants my account to this dump badly enough they can have it.

Been using this as a moderator for the past few months now and it's been working great. Thank you! One follow up question though: Any update on having some sort of icon that indicates when a moderator has 2FA enabled so we can hassle other members of our team to turn it on? _(This icon ideally only being visible to other moderators so we don't advertise who on the team is least secure.)_