We've decided that we won't be working on this project. Sorry to all the people who were in favour of it.

[Related: Two factor authentication for Stack Exchange]

So, over the last couple of weeks, I built a bare-bones two-factor authentication system for Stack Exchange OpenID. Currently, it only supports:

  1. Logging in via Stack Exchange OpenID
  2. Google Authenticator-style code generation
  3. Recovery codes

It does not currently support:

  1. Logging in via our sites, Careers, mobile apps, etc.
  2. SMS-based code generation or recovery
  3. Any other integration with our sites

Before we ship this feature, we probably want to finish at least the site login/integration and SMS stuff. So the questions are:

  1. Would people actually use two-factor authentication for Stack Exchange OpenID if we completed this feature?
  2. What other features should we implement before this would be considered a completed two-factor authentication system?

Your input will help us determine whether to continue with the project or shelve it. :-)

  • 13
    I'll just sit here tapping my foot, waiting… – Tim Stone May 19 '15 at 23:04
  • @TimStone Is that your way of abstaining yourself from having an opinion on the subject? ;-) – Chris Jester-Young May 19 '15 at 23:45
  • 3
    No. Too complicated for me. – bjb568 May 19 '15 at 23:49
  • 1
    You mean I actually have to login to stack exchange? I'm not sure I even remember my password. I thought you magically pulled my password from my brain, which is why I never had to login anymore – psubsee2003 May 20 '15 at 0:02
  • 1
    @psubsee2003 Most people log in to our sites via Google or Facebook. However, some people do use the email/password option, and we're trying to decide whether to complete the implementation of two-factor authentication for that. People who use Google or Facebook to log in won't be affected. – Chris Jester-Young May 20 '15 at 0:04
  • Oh, no, I'm just waiting for you to finish it and roll it out so I can use it. I don't currently use my Stack Exchange OpenID for anything particularly sensitive, but that wouldn't preclude me from enabling 2FA for the peace of mind. – Tim Stone May 20 '15 at 2:14
  • 3
    Also in the off chance that this is what David said he had nothing against but thought was a giant waste of time you can tell him I don't care and he's a n00b. Otherwise never mind and carry on. :P – Tim Stone May 20 '15 at 2:15
  • 3
    I've noticed other site(s) have implemented this, and to be honest, in most cases I see it as nothing more than a "phishing" attempt to grab user's phone numbers. Like one site I know of, had this as "optional" before when creating a new account. But now they won't let you create a new account without giving a valid phone number. Ok, so I don't use them anymore. I don't think SE would make this mandatory but you never know the future. Sure, if SE had like "money bounties" and such, it'd be a nice optional feature, but don't see much point in it right now. – CRABOLO May 20 '15 at 2:20
  • @TimStone To be honest, I have no horse in this race. So if you're the only voice in support of this, it most likely won't happen. – Chris Jester-Young May 20 '15 at 3:14
  • 8
    Meh, if implementing it for the sake of security isn't reason enough then someone should go back and admit to all the people who have complained about the password policy that they were right in saying that there's no real point in being concerned about a SE OpenID being compromised. – Tim Stone May 20 '15 at 3:33
  • 1
    Please do. I'm currently using SE OpenID for Nuiton (a repository hosting service) and it's the only place I trust my SE OpenID with. Having my SE OpenID guarded by 2FA is an option I'm keen in having. – Unihedron May 20 '15 at 9:30
  • 2FA might make users more likely to use it for other sites. How does that tie in with the original reasoning for making the login OpenID compatible in the first case (as opposed to just a login for SE only)? – George Duckett May 20 '15 at 11:46
  • I think it probably has added value for moderators (and would use it because of that), as this can reveal some personal info about people, and can be used to "troll" people in various ways. Note that I would only use it if it doesn't require a 'smartphone', as I don't own one. – Martin Tournoij May 20 '15 at 11:47
  • @Carpetsmoker If we go ahead with the project, an SMS option will be added. It's optional, of course; people who do have smartphones are not required to share their SMS number with us. – Chris Jester-Young May 20 '15 at 12:53
  • 1
    We've decided that we won't be working on this project. Sorry to all the people who were in favour of it. – Chris Jester-Young May 26 '15 at 20:19

This question really depends on what sites people are using to log into with using their Stack Exchange OpenID accounts. I'm going to assume most are just using it for SE network sites and is the basis of my following thoughts:

Seems to me two-factor is really about securing valuable data (bank, email, etc). I'm not really sure that stack exchange stuff fits that category. If someone were to gain access to your account, what are the worst things they could do? In most cases, pretty benign thing (mess up your rep, get you reported, etc) that could be appealed once found out.

I would say of all the sites, the only one with potentially a bit of sensitive information is Careers. If the information there is sensitive enough to warrant 2FA from any OpenID provider, I would say it makes sense for the SE OpenID provider to implement it.

That said, I probably wouldn't use it, even with Careers, because I consider the risk pretty low for me.

  • 2
    I agree with this answer, but I don't believe that due to my non-use of 2FA, it shouldn't be implemented. – hichris123 May 20 '15 at 1:57
  • 2
    @hichris123 Still, we don't believe in building white elephants. So if there really isn't interest for the feature, it will indeed get scrapped. As I mentioned in my answer to Tim Stone, I'm personally indifferent to the outcome of this discussion. – Chris Jester-Young May 20 '15 at 3:23
  • It depends on how much rep I have, for example, if I have 20k rep or I'm a mod, someone could do a lot of damage with my login details. – JonasCz May 20 '15 at 13:17

I believe that I agree very closely with Tim Stone and that the proper thing is to do this because it's the right thing to do for security. We should be encouraging proper behavioral practices. StackExchange OpenID is almost certainly used solely by developers (who has stats and magic, I would love to know how many non-techies use the SE OID endpoint for login) or other highly-IT savvy folks, and I believe that if we want the majority of developers to adopt certain features, it is the responsibility of organizations like Microsoft, Google, Apple and StackExchange, resources that we all love and adopt madly, to support proper behavioral patterns.

I get that this is likely to be a low-used feature, and I get that it seems like a giant waste of time, but I believe it is the right thing to do. StackExchange has always been about building the right tools for the community, and not about chasing pipe dreams.

If the choice is between 2FA and more April Fools jokes, I want 2FA. If the difference is between 2FA and a better revamp of an existing feature (hello vastly improved profile pages) then I would need to hear what the other feature is.

In direct contravention to https://meta.stackexchange.com/a/256768/146986 (which I upvoted) I think that this isn't about "what are people protecting with their login" because I have 2FA on Facebook and Google and I use those to login to sites I don't care about. I want the OpenID endpoint to be secure so that it doesn't matter what site I use it for.

Full disclosure: I honestly don't use this endpoint for many other services, but not because I don't trust it, but because I have so many to choose from, and I just go for easy. But that's not to say that I think less of this endpoint. I definitely want it to be a great resource.

I would definitely use this feature if it gets added. In fact, I inquired about this feature in the past from this post here.

I disagree with the sentiment that 2FA is only about securing valuable data. Having had my bitcointalk account hacked in the past and the lax security attitude by the mods and administrators that run that forum, I make it a habit now to always use 2FA where possible.

For me it's about safeguarding my rep and my own participation in SE -- the last thing I would want happen is a malicious actor getting access into my SE account and wreaking havoc to my online identity. Any 2FA mechanism you can add to make their jobs harder is a good thing.

The main argument against adding 2FA is that it creates more friction for the user during login. But this is a solvable problem; instead of implementing your typical 2FA implementation, as done by so many other sites, just use Clef instead. This gives you the benefits of 2FA without any of the login friction -- if anything it will make logging into SE even easier.

  • 1
    Your original wording made the proposal more intriguing :D – James May 20 '15 at 14:15
  • Clef is an OAuth 2.0 provider, so it would hook in at the site/Careers/mobile app level, not at the StackID level. So that would be a separate project idea, and not part of this project. :-( – Chris Jester-Young May 20 '15 at 14:40
  • @James yes I'm sure it did :P – greatwolf May 20 '15 at 19:16

I agree with Darren Kopp that there isn't a demonstrated need for heightened security, and I wouldn't use it.

Furthermore, I think this feature will inhibit casual use of the sites. Inevitable, some of new users will set it up just because it's there, and security is good. Then they'll be less likely to log in from another computer because of the hassle. I know I'm avoiding logging in to the sites for which I have set up 2FA, unless it's necessary.

  • 1
    Should be upvoted a thousand times. 2FA is a drag on productivity and will discourage users. – Deer Hunter May 20 '15 at 7:44

Will usage of 2FA be configurable by the users? I think this will solve a couple of the problems others have mentioned.

No. Too complicated for me. – bjb568 13 hours ago

Should be upvoted a thousand times. 2FA is a drag on productivity and will discourage users. – Deer Hunter 5 hours ago

I've noticed other site(s) have implemented this, and to be honest, in most cases I see it as nothing more than a "phishing" attempt to grab user's phone numbers. Like one site I know of, had this as "optional" before when creating a new account. But now they won't let you create a new account without giving a valid phone number. Ok, so I don't use them anymore. I don't think SE would make this mandatory but you never know the future. Sure, if SE had like "money bounties" and such, it'd be a nice optional feature, but don't see much point in it right now. – Roombatron5000 11 hours ago

By having it configurable and off by default (unfortunately), the work flow to sign up can remain unchanged. Existing users are also unaffected if they don't wish to utilize the feature. However, users that do want the additional protection can enable it.

I would utilize the feature. I am rarely required to log in to any of the sites on the network I utilize. The "inconvenience" of waiting for an SMS or an email to ensure I am who I say I am is negligible. As a moderator on one of the sites, it'd also be nice to know the extra layer exists.

  • I suspect it would, as most of these services are opt-in anyways. Google and Facebook, as examples, are opt-in. – jcolebrand May 20 '15 at 13:42
  • 3
    Yes, it is totally opt-in (off by default). – Chris Jester-Young May 20 '15 at 13:55

My current use of 2FA is mainly my gmail account. For the moment, it is my go to OpenID provider I use to log on multiple other sites. Why do I still keep on with it:

  1. It has 2FA, which is an additional layer of protection for this single point of failure.
  2. It is recognised by other site as a "default" OpenID provider

I agree that for protection of StackExchange accounts, this might be a bit overkill. However, it's a real added value for protection of an OpenID account used in many other sites. So I guess, implementation of the 2FA for SE is a question of what do you want it to be.

I would use it. We should get in the habit of enabling 2FA on every site. That should be the norm for every site to enable 2FA, U2F and HTTPS at some point. I understand that it is not a feature to add at the beginning but not adding it at all (especially for site this big!) is a mistake to say at least.

  • 1
    [I don't work for SE any more, so this is just my personal opinion.] So, personally, I agree with you: we should use 2FA everywhere. However, a big argument for not implementing it was that most people who use SE use Google (which already has 2FA) as their authentication provider, rather than StackID, so 2FA at StackID would not be widely used. – Chris Jester-Young Feb 15 '17 at 19:59
  • 1
    In so saying, now that StackID is open-source, I would be happy to implement this as an outside contributor. (By "outside contributor", I mean that I no longer have the original implementation, and I'd be rewriting this from scratch.) This does not mean that SE will adopt the code; it would just enable third-party sites who use StackID on their own servers to use it. – Chris Jester-Young Feb 15 '17 at 20:00
  • 1
    Also, note that implementing it at the StackID level is not sufficient for it to be used at SE; the SE sites have a login form that forwards the credentials to StackID, as does the mobile app, and those would have to be adapted too. That's part of what led to the belief that it'd be too much work for very little gain. – Chris Jester-Young Feb 15 '17 at 20:04
  • I know that now many people would use 2FA with StackID but still SE should promote security by enabling 2FA on their StackID. Logging with Google, FB or other 3rd party sites is dangerous when it comes to privacy. So using 2FA with StackID is the optimal solution when it comes to privacy. Thus, imo SE should promote privacy because developers might just copy their behavior and just implement logging with Google instead of implementing 2FA. I know it would require some money but it would be beneficial in the long run. Perhaps it's the lack of 2FA that makes people log with Google, not StackID. – user1 Feb 20 '17 at 14:45
  • I know that people just don't care about privacy when it comes to spending money but I'm just here to promote the right thing to do. I know that I probably won't change anything and I know the reasons but I have to try. Thank you for wanting to implement it yourself in your free time. :-) A gleam of hope. – user1 Feb 20 '17 at 14:48

For me personally, I don't really bother. I wouldn't use it.

For me this is on the 'could have' list, and there is a lot more that could have the attention of the development team instead of this feature that gives a nice show-off, but doesn't really add value.

If Stackexchange ever implemented 2FA such as U2F , Time-based OTP or other similar solutions I would gladly use it! I agree with Tim Stone that if increased security is not reason enough, then it should probably be admitted that there is no real need for use of any strong passwords at all for SE OpenID.

I also agree with jcolebrand in that we should encourage good behavioral security practices and not let it be dependent on what kind of information you are trying to protect. I'm starting to take 2FA for granted and whenever I have to create an account on a site that doesn't support it I'm a bit hesitant and get the feeling that they don't really care enough about my security.

As much as possible I prefer to keep separate accounts for each individual website I register to mostly because I don't want to have my whole online identity tied to one provider like Google. Thus I do not see the alternative to use another provider such as Google to get 2FA as a good solution at all. I enjoy my freedom of choice and would very much like the opportunity to be able to utilize SE OpenID with atleast as good security as if I would have used another OpenID provider.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .