57

Is there any possibility of setting up two-factor authentication (2FA) for Stack Exchange OpenID authentication?

I could just use my (already 2FA-enabled) Google account for Stack Exchange, but I would prefer to continue use Stack Exchange OpenID.

After Heartbleed (which, I appreciate, didn't affect Stack Exchange, as you use IIS and Schannel, not OpenSSL), there have been a lot of recommendations to change passwords and to enable 2FA where possible.

So, what are the chances of a text-messaging-based or Google-Authenticator-based 2FA for Stack Exchange?

Improve this question
3
  • This request feels like a knee-jerk reaction to heartbleed - what will 2FA on SE sites give you over the current use of OpenId?
    – Oded
    Apr 25, 2014 at 17:09
  • It is a bit of a heartbleed knee-jerk. If I use a non-SE OpenID, then it gets me nothing. If I use an SE OpenID, then it makes that account (which, for many people, carries a large fraction of their public presence) more secure. I'd hate to lose my twitter account, even though it wouldn't get the hacker into my bank account - and the same applies to SE.
    – Richard Gadsden
    Apr 25, 2014 at 17:12
  • 7
    For the sake of accuracy, Stack Exchange was affected by Heartbleed since all SSL connections are terminated at a load balancer instance using the affected versions of OpenSSL. Source
    – Steven V
    Apr 25, 2014 at 17:21

2 Answers 2

Reset to default
8

Setup Two-Factor Authentication Only Login

If there is an existing account with a username and password directly tied to a StackExchange account, that login type can be removed in order to have access only through an account login that supports two-factor authentication (TFA)/ multi-factor authentication (MFA) such as GitHub or Google.

Setup

  1. Enable a two-factor authentication (TFA) service. i.e. GitHub or Google
  2. Remove StackExchange based login: Profile > Edit profile and settings > My logins
  3. Select remove for the existing StackExchange account.

After these steps, the original StackExchange account login and password will no longer work when trying to log in. The TFA account login will be the only account used to access the account.

Improve this answer
2
  • 2
    I wish to downvote this but haven't as there's nothing fundamentally wrong, however... what if the other websites are down when you want to login? What about privacy? what about users who will rather keep accounts/logins isolated? I believe every site offering a login should offer their independent login method (here, OpenID) and then they must support 2FA, at the very least TOTP.
    – BhaveshDiwan
    Aug 12, 2022 at 23:30
  • 3
    I agree with you @BhaveshDiwan. My solution is a sub-optimal workaround. The best case is Yubikey MFA integration.
    – AdamHurwitz
    Aug 13, 2022 at 18:07
4

We won't be implementing this for the time being. See If we built two-factor authentication for Stack Exchange OpenID, would you use it? for more details.

Improve this answer
6
  • 28
    But why? How come such big site does not support 2FA? Sorry if I sound stupid but honestly don't get it! My SE account means lots to me
    – user1298069
    Nov 9, 2015 at 23:28
  • 1
    @user1298069 Most users use Google to log in to Stack Exchange, rather than using Stack Exchange OpenID. Google already supports 2FA. The main reason we chose not to go ahead is that not many people use Stack Exchange OpenID, and of those who commented in the linked thread, most stated that they would not use 2FA if we implemented it.
    – C. K. Young
    Nov 10, 2015 at 5:19
  • 10
    @ChrisJester-Young some people like me especially avoid Google for privacy reasons. I'd never use Google or (even worse) Facebook for that. Now what do I do to keep my login safe if I have to login from machines which are not my own – and if it comes to an extreme, are running Windows 10? Currently, that keeps me off the site in such situations. Being a mod on 2 sites this also means I put additional load on the shoulders of my co-mods, which could be avoided.
    – Izzy
    Dec 13, 2018 at 12:56
  • 2
    @Izzy I don't work for the company any more, so it's nothing I can do anything about. In so saying, I agree with you, of course. I am a 2FA fiend and have nearly 100 accounts on my Authy. The team's decision was that it would only be implemented if there were enough community support for it, and sadly there wasn't. :-(
    – C. K. Young
    Dec 14, 2018 at 18:50
  • 2
    Thanks Chris! How many upvotes do you think this post will need to be convincing? Grasping for straws…
    – Izzy
    Dec 14, 2018 at 19:54
  • 1
    I abso-bloody-lutely agree with @Izzy I don't want to use any third-party methods to login, Google, Facebook or whatever... If I use site X, I would only want to use site X login methods. Privacy trumps over convenience..... If I use SE, I want to use SE OpenID. Not having TOTP any any other form of 2FA is outright disappointment.
    – BhaveshDiwan
    Aug 12, 2022 at 23:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .