We've decided that we won't be working on this project. Sorry to all the people who were in favour of it.

[Related: Two factor authentication for Stack Exchange]

So, over the last couple of weeks, I built a bare-bones two-factor authentication system for Stack Exchange OpenID. Currently, it only supports:

  1. Logging in via Stack Exchange OpenID
  2. Google Authenticator-style code generation
  3. Recovery codes

It does not currently support:

  1. Logging in via our sites, Careers, mobile apps, etc.
  2. SMS-based code generation or recovery
  3. Any other integration with our sites

Before we ship this feature, we probably want to finish at least the site login/integration and SMS stuff. So the questions are:

  1. Would people actually use two-factor authentication for Stack Exchange OpenID if we completed this feature?
  2. What other features should we implement before this would be considered a completed two-factor authentication system?

Your input will help us determine whether to continue with the project or shelve it. :-)

  • 19
    I'll just sit here tapping my foot, waiting…
    – Tim Stone
    Commented May 19, 2015 at 23:04
  • @TimStone Is that your way of abstaining yourself from having an opinion on the subject? ;-) Commented May 19, 2015 at 23:45
  • 3
    No. Too complicated for me.
    – bjb568
    Commented May 19, 2015 at 23:49
  • 1
    You mean I actually have to login to stack exchange? I'm not sure I even remember my password. I thought you magically pulled my password from my brain, which is why I never had to login anymore Commented May 20, 2015 at 0:02
  • 1
    @psubsee2003 Most people log in to our sites via Google or Facebook. However, some people do use the email/password option, and we're trying to decide whether to complete the implementation of two-factor authentication for that. People who use Google or Facebook to log in won't be affected. Commented May 20, 2015 at 0:04
  • Oh, no, I'm just waiting for you to finish it and roll it out so I can use it. I don't currently use my Stack Exchange OpenID for anything particularly sensitive, but that wouldn't preclude me from enabling 2FA for the peace of mind.
    – Tim Stone
    Commented May 20, 2015 at 2:14
  • 3
    Also in the off chance that this is what David said he had nothing against but thought was a giant waste of time you can tell him I don't care and he's a n00b. Otherwise never mind and carry on. :P
    – Tim Stone
    Commented May 20, 2015 at 2:15
  • 3
    I've noticed other site(s) have implemented this, and to be honest, in most cases I see it as nothing more than a "phishing" attempt to grab user's phone numbers. Like one site I know of, had this as "optional" before when creating a new account. But now they won't let you create a new account without giving a valid phone number. Ok, so I don't use them anymore. I don't think SE would make this mandatory but you never know the future. Sure, if SE had like "money bounties" and such, it'd be a nice optional feature, but don't see much point in it right now.
    Commented May 20, 2015 at 2:20
  • @TimStone To be honest, I have no horse in this race. So if you're the only voice in support of this, it most likely won't happen. Commented May 20, 2015 at 3:14
  • 10
    Meh, if implementing it for the sake of security isn't reason enough then someone should go back and admit to all the people who have complained about the password policy that they were right in saying that there's no real point in being concerned about a SE OpenID being compromised.
    – Tim Stone
    Commented May 20, 2015 at 3:33
  • 2
    Please do. I'm currently using SE OpenID for Nuiton (a repository hosting service) and it's the only place I trust my SE OpenID with. Having my SE OpenID guarded by 2FA is an option I'm keen in having.
    – Unihedron
    Commented May 20, 2015 at 9:30
  • 2FA might make users more likely to use it for other sites. How does that tie in with the original reasoning for making the login OpenID compatible in the first case (as opposed to just a login for SE only)? Commented May 20, 2015 at 11:46
  • I think it probably has added value for moderators (and would use it because of that), as this can reveal some personal info about people, and can be used to "troll" people in various ways. Note that I would only use it if it doesn't require a 'smartphone', as I don't own one. Commented May 20, 2015 at 11:47
  • 2
    We've decided that we won't be working on this project. Sorry to all the people who were in favour of it. Commented May 26, 2015 at 20:19
  • 1
    One more quite vocal and resounding support for 2FA. Seriously, if the security is not good enough reason, then what is? do we need polls and questionnaires about whether we need password or not? no, we do not! So, the 2FA is just a next step towards "better passwords". It's weird that we're discussing at all whether we need it or not.. and yes - not all the people use (are willing to use) Facebook's, Google's or something else's 2FA. Commented Jul 5, 2023 at 6:27

10 Answers 10


I believe that I agree very closely with Tim Stone and that the proper thing is to do this because it's the right thing to do for security. We should be encouraging proper behavioral practices. StackExchange OpenID is almost certainly used solely by developers (who has stats and magic, I would love to know how many non-techies use the SE OID endpoint for login) or other highly-IT savvy folks, and I believe that if we want the majority of developers to adopt certain features, it is the responsibility of organizations like Microsoft, Google, Apple and StackExchange, resources that we all love and adopt madly, to support proper behavioral patterns.

I get that this is likely to be a low-used feature, and I get that it seems like a giant waste of time, but I believe it is the right thing to do. StackExchange has always been about building the right tools for the community, and not about chasing pipe dreams.

If the choice is between 2FA and more April Fools jokes, I want 2FA. If the difference is between 2FA and a better revamp of an existing feature (hello vastly improved profile pages) then I would need to hear what the other feature is.

In direct contravention to https://meta.stackexchange.com/a/256768/146986 (which I upvoted) I think that this isn't about "what are people protecting with their login" because I have 2FA on Facebook and Google and I use those to login to sites I don't care about. I want the OpenID endpoint to be secure so that it doesn't matter what site I use it for.

Full disclosure: I honestly don't use this endpoint for many other services, but not because I don't trust it, but because I have so many to choose from, and I just go for easy. But that's not to say that I think less of this endpoint. I definitely want it to be a great resource.


I would definitely use this feature if it gets added. In fact, I inquired about this feature in the past from this post here.

I disagree with the sentiment that 2FA is only about securing valuable data. Having had my bitcointalk account hacked in the past and the lax security attitude by the mods and administrators that run that forum, I make it a habit now to always use 2FA where possible.

For me it's about safeguarding my rep and my own participation in SE -- the last thing I would want happen is a malicious actor getting access into my SE account and wreaking havoc to my online identity. Any 2FA mechanism you can add to make their jobs harder is a good thing.

The main argument against adding 2FA is that it creates more friction for the user during login. But this is a solvable problem; instead of implementing your typical 2FA implementation, as done by so many other sites, just use Clef instead. This gives you the benefits of 2FA without any of the login friction -- if anything it will make logging into SE even easier.

  • 1
    Your original wording made the proposal more intriguing :D
    – James
    Commented May 20, 2015 at 14:15
  • Clef is an OAuth 2.0 provider, so it would hook in at the site/Careers/mobile app level, not at the StackID level. So that would be a separate project idea, and not part of this project. :-( Commented May 20, 2015 at 14:40
  • @James yes I'm sure it did :P
    – greatwolf
    Commented May 20, 2015 at 19:16

This question really depends on what sites people are using to log into with using their Stack Exchange OpenID accounts. I'm going to assume most are just using it for SE network sites and is the basis of my following thoughts:

Seems to me two-factor is really about securing valuable data (bank, email, etc). I'm not really sure that stack exchange stuff fits that category. If someone were to gain access to your account, what are the worst things they could do? In most cases, pretty benign thing (mess up your rep, get you reported, etc) that could be appealed once found out.

I would say of all the sites, the only one with potentially a bit of sensitive information is Careers. If the information there is sensitive enough to warrant 2FA from any OpenID provider, I would say it makes sense for the SE OpenID provider to implement it.

That said, I probably wouldn't use it, even with Careers, because I consider the risk pretty low for me.

  • 4
    I agree with this answer, but I don't believe that due to my non-use of 2FA, it shouldn't be implemented.
    – hichris123
    Commented May 20, 2015 at 1:57
  • 2
    @hichris123 Still, we don't believe in building white elephants. So if there really isn't interest for the feature, it will indeed get scrapped. As I mentioned in my answer to Tim Stone, I'm personally indifferent to the outcome of this discussion. Commented May 20, 2015 at 3:23
  • It depends on how much rep I have, for example, if I have 20k rep or I'm a mod, someone could do a lot of damage with my login details. Commented May 20, 2015 at 13:17
  • I don't think this is a fair assessment of what has value to users, and certainly don't think it's fair to generalize what all users find to be valuable. If the reputation of questions and answers being offered on Stack Exchange websites is not important, this raises many questions. For individuals as myself, who represent companies as developer advocates, there is certainly a risk in having my account compromised for nefarious purposes. I have taken responsibility of securing my account by removing SE's insecure email login and recommend others to do the same. Commented Oct 5, 2020 at 0:05
  • With the addition of stack overflow jobs, this is arguably the most valuable online resource I have, even more so than any online banking system. It really isn't that hard to make, please make it happen.
    – Automatico
    Commented Jan 4, 2022 at 12:23
  • "If someone were to gain access to your account, what are the worst things they could do?" In my case: destroying the accounts of some users on multiple SE sites – maybe including yours, and useful posts on the way. How? I'm a mod on multiple SE sites. "With great power comes great responsibility", so I would definitely use 2FA (and no, being a person with a focus on privacy, I wouldn't register an account on Google or Facebook for that purpose). So I'd really expect SE to take care for this protection, and not pointing to such 3rd parties for it.
    – Izzy
    Commented Aug 13, 2022 at 21:33

Will usage of 2FA be configurable by the users? I think this will solve a couple of the problems others have mentioned.

No. Too complicated for me. – bjb568 13 hours ago

Should be upvoted a thousand times. 2FA is a drag on productivity and will discourage users. – Deer Hunter 5 hours ago

I've noticed other site(s) have implemented this, and to be honest, in most cases I see it as nothing more than a "phishing" attempt to grab user's phone numbers. Like one site I know of, had this as "optional" before when creating a new account. But now they won't let you create a new account without giving a valid phone number. Ok, so I don't use them anymore. I don't think SE would make this mandatory but you never know the future. Sure, if SE had like "money bounties" and such, it'd be a nice optional feature, but don't see much point in it right now. – Roombatron5000 11 hours ago

By having it configurable and off by default (unfortunately), the work flow to sign up can remain unchanged. Existing users are also unaffected if they don't wish to utilize the feature. However, users that do want the additional protection can enable it.

I would utilize the feature. I am rarely required to log in to any of the sites on the network I utilize. The "inconvenience" of waiting for an SMS or an email to ensure I am who I say I am is negligible. As a moderator on one of the sites, it'd also be nice to know the extra layer exists.

  • I suspect it would, as most of these services are opt-in anyways. Google and Facebook, as examples, are opt-in.
    – jcolebrand
    Commented May 20, 2015 at 13:42
  • 3
    Yes, it is totally opt-in (off by default). Commented May 20, 2015 at 13:55
  • As on other sites (like Codeberg, GitLab or Github), this would be opt-in. And why should it need a phone number? There's TOTP (Time-based One Time Passwords) easy to be used with apps like Google Authenticator, there are hardware tokens like the NitroKey or the YubiKey (just plug it into your USB port and tap it to confirm), to mention only 2 easy methods. So those who think they do not need it can skip it – and those who want it can use it. Especially for accounts with higher responsibility (moderators, admins) this is highly recommended.
    – Izzy
    Commented Aug 13, 2022 at 21:41

I agree with Darren Kopp that there isn't a demonstrated need for heightened security, and I wouldn't use it.

Furthermore, I think this feature will inhibit casual use of the sites. Inevitable, some of new users will set it up just because it's there, and security is good. Then they'll be less likely to log in from another computer because of the hassle. I know I'm avoiding logging in to the sites for which I have set up 2FA, unless it's necessary.

  • 1
    Should be upvoted a thousand times. 2FA is a drag on productivity and will discourage users. Commented May 20, 2015 at 7:44
  • 2
    Authenticator apps make 2FA easier than SMSes.
    – ahorn
    Commented Dec 10, 2018 at 8:58

If Stackexchange ever implemented 2FA such as U2F , Time-based OTP or other similar solutions I would gladly use it! I agree with Tim Stone that if increased security is not reason enough, then it should probably be admitted that there is no real need for use of any strong passwords at all for SE OpenID.

I also agree with jcolebrand in that we should encourage good behavioral security practices and not let it be dependent on what kind of information you are trying to protect. I'm starting to take 2FA for granted and whenever I have to create an account on a site that doesn't support it I'm a bit hesitant and get the feeling that they don't really care enough about my security.

As much as possible I prefer to keep separate accounts for each individual website I register to mostly because I don't want to have my whole online identity tied to one provider like Google. Thus I do not see the alternative to use another provider such as Google to get 2FA as a good solution at all. I enjoy my freedom of choice and would very much like the opportunity to be able to utilize SE OpenID with atleast as good security as if I would have used another OpenID provider.


I would use it. We should get in the habit of enabling 2FA on every site. That should be the norm for every site to enable 2FA, U2F and HTTPS at some point. I understand that it is not a feature to add at the beginning but not adding it at all (especially for site this big!) is a mistake to say at least.

  • 1
    [I don't work for SE any more, so this is just my personal opinion.] So, personally, I agree with you: we should use 2FA everywhere. However, a big argument for not implementing it was that most people who use SE use Google (which already has 2FA) as their authentication provider, rather than StackID, so 2FA at StackID would not be widely used. Commented Feb 15, 2017 at 19:59
  • 1
    In so saying, now that StackID is open-source, I would be happy to implement this as an outside contributor. (By "outside contributor", I mean that I no longer have the original implementation, and I'd be rewriting this from scratch.) This does not mean that SE will adopt the code; it would just enable third-party sites who use StackID on their own servers to use it. Commented Feb 15, 2017 at 20:00
  • 1
    Also, note that implementing it at the StackID level is not sufficient for it to be used at SE; the SE sites have a login form that forwards the credentials to StackID, as does the mobile app, and those would have to be adapted too. That's part of what led to the belief that it'd be too much work for very little gain. Commented Feb 15, 2017 at 20:04
  • I know that now many people would use 2FA with StackID but still SE should promote security by enabling 2FA on their StackID. Logging with Google, FB or other 3rd party sites is dangerous when it comes to privacy. So using 2FA with StackID is the optimal solution when it comes to privacy. Thus, imo SE should promote privacy because developers might just copy their behavior and just implement logging with Google instead of implementing 2FA. I know it would require some money but it would be beneficial in the long run. Perhaps it's the lack of 2FA that makes people log with Google, not StackID.
    – user1
    Commented Feb 20, 2017 at 14:45
  • I know that people just don't care about privacy when it comes to spending money but I'm just here to promote the right thing to do. I know that I probably won't change anything and I know the reasons but I have to try. Thank you for wanting to implement it yourself in your free time. :-) A gleam of hope.
    – user1
    Commented Feb 20, 2017 at 14:48

My current use of 2FA is mainly my gmail account. For the moment, it is my go to OpenID provider I use to log on multiple other sites. Why do I still keep on with it:

  1. It has 2FA, which is an additional layer of protection for this single point of failure.
  2. It is recognised by other site as a "default" OpenID provider

I agree that for protection of StackExchange accounts, this might be a bit overkill. However, it's a real added value for protection of an OpenID account used in many other sites. So I guess, implementation of the 2FA for SE is a question of what do you want it to be.


For me personally, I don't really bother. I wouldn't use it.

For me this is on the 'could have' list, and there is a lot more that could have the attention of the development team instead of this feature that gives a nice show-off, but doesn't really add value.


I would use it

I suggest by default to not activate it on new accounts. So that only interested users could opt-in.

I would be happy to contribute testing

Not the answer you're looking for? Browse other questions tagged .