Is there any possibility of setting up two factor authentication (2FA) for Stack Exchange OpenID authentication?

I could just use my (already 2FA-enabled) Google account for Stack Exchange, but I would prefer to continue use Stack Exchange OpenID.

After Heartbleed (which, I appreciate, didn't affect Stack Exchange, as you use IIS and Schannel, not OpenSSL), there have been a lot of recommendations to change passwords and to enable 2FA where possible.

So, what are the chances of a text-messaging-based or Google-Authenticator-based 2FA for Stack Exchange?

  • This request feels like a knee-jerk reaction to heartbleed - what will 2FA on SE sites give you over the current use of OpenId? – Oded Apr 25 '14 at 17:09
  • It is a bit of a heartbleed knee-jerk. If I use a non-SE OpenID, then it gets me nothing. If I use an SE OpenID, then it makes that account (which, for many people, carries a large fraction of their public presence) more secure. I'd hate to lose my twitter account, even though it wouldn't get the hacker into my bank account - and the same applies to SE. – Richard Gadsden Apr 25 '14 at 17:12
  • 6
    For the sake of accuracy, Stack Exchange was affected by Heartbleed since all SSL connections are terminated at a load balancer instance using the affected versions of OpenSSL. Source – Steven V Apr 25 '14 at 17:21

We won't be implementing this for the time being. See If we built two-factor authentication for Stack Exchange OpenID, would you use it? for more details.

  • 9
    But why? How come such big site does not support 2FA? Sorry if I sound stupid but honestly don't get it! My SE account means lots to me – user1298069 Nov 9 '15 at 23:28
  • 1
    @user1298069 Most users use Google to log in to Stack Exchange, rather than using Stack Exchange OpenID. Google already supports 2FA. The main reason we chose not to go ahead is that not many people use Stack Exchange OpenID, and of those who commented in the linked thread, most stated that they would not use 2FA if we implemented it. – Chris Jester-Young Nov 10 '15 at 5:19
  • @ChrisJester-Young some people like me especially avoid Google for privacy reasons. I'd never use Google or (even worse) Facebook for that. Now what do I do to keep my login safe if I have to login from machines which are not my own – and if it comes to an extreme, are running Windows 10? Currently, that keeps me off the site in such situations. Being a mod on 2 sites this also means I put additional load on the shoulders of my co-mods, which could be avoided. – Izzy Dec 13 '18 at 12:56
  • @Izzy I don't work for the company any more, so it's nothing I can do anything about. In so saying, I agree with you, of course. I am a 2FA fiend and have nearly 100 accounts on my Authy. The team's decision was that it would only be implemented if there were enough community support for it, and sadly there wasn't. :-( – Chris Jester-Young Dec 14 '18 at 18:50
  • Thanks Chris! How many upvotes do you think this post will need to be convincing? Grasping for straws… – Izzy Dec 14 '18 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .