40

Is there any possibility of setting up two factor authentication (2FA) for Stack Exchange OpenID authentication?

I could just use my (already 2FA-enabled) Google account for Stack Exchange, but I would prefer to continue use Stack Exchange OpenID.

After Heartbleed (which, I appreciate, didn't affect Stack Exchange, as you use IIS and Schannel, not OpenSSL), there have been a lot of recommendations to change passwords and to enable 2FA where possible.

So, what are the chances of a text-messaging-based or Google-Authenticator-based 2FA for Stack Exchange?

3
  • This request feels like a knee-jerk reaction to heartbleed - what will 2FA on SE sites give you over the current use of OpenId?
    – Oded
    Apr 25 '14 at 17:09
  • It is a bit of a heartbleed knee-jerk. If I use a non-SE OpenID, then it gets me nothing. If I use an SE OpenID, then it makes that account (which, for many people, carries a large fraction of their public presence) more secure. I'd hate to lose my twitter account, even though it wouldn't get the hacker into my bank account - and the same applies to SE. Apr 25 '14 at 17:12
  • 7
    For the sake of accuracy, Stack Exchange was affected by Heartbleed since all SSL connections are terminated at a load balancer instance using the affected versions of OpenSSL. Source
    – Steven V
    Apr 25 '14 at 17:21
4

We won't be implementing this for the time being. See If we built two-factor authentication for Stack Exchange OpenID, would you use it? for more details.

5
  • 16
    But why? How come such big site does not support 2FA? Sorry if I sound stupid but honestly don't get it! My SE account means lots to me Nov 9 '15 at 23:28
  • 1
    @user1298069 Most users use Google to log in to Stack Exchange, rather than using Stack Exchange OpenID. Google already supports 2FA. The main reason we chose not to go ahead is that not many people use Stack Exchange OpenID, and of those who commented in the linked thread, most stated that they would not use 2FA if we implemented it. Nov 10 '15 at 5:19
  • 4
    @ChrisJester-Young some people like me especially avoid Google for privacy reasons. I'd never use Google or (even worse) Facebook for that. Now what do I do to keep my login safe if I have to login from machines which are not my own – and if it comes to an extreme, are running Windows 10? Currently, that keeps me off the site in such situations. Being a mod on 2 sites this also means I put additional load on the shoulders of my co-mods, which could be avoided.
    – Izzy
    Dec 13 '18 at 12:56
  • 1
    @Izzy I don't work for the company any more, so it's nothing I can do anything about. In so saying, I agree with you, of course. I am a 2FA fiend and have nearly 100 accounts on my Authy. The team's decision was that it would only be implemented if there were enough community support for it, and sadly there wasn't. :-( Dec 14 '18 at 18:50
  • 2
    Thanks Chris! How many upvotes do you think this post will need to be convincing? Grasping for straws…
    – Izzy
    Dec 14 '18 at 19:54
2

Setup Two-Factor Authentication Only Login

If there is an existing account with a username and password directly tied to a StackExchange account, that login type can be removed in order to have access only through an account login that supports two-factor authentication (TFA)/ multi-factor authentication (MFA) such as GitHub or Google.

Setup

  1. Enable a two-factor authentication (TFA) service. i.e. GitHub or Google
  2. Remove StackExchange based login: Profile > Edit profile and settings > My logins
  3. Select remove for the existing StackExchange account.

After these steps, the original StackExchange account login and password will no longer work when trying to log in. The TFA account login will be the only account used to access the account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .