If we built two-factor authentication for Stack Exchange OpenID, would you use it? [closed]

Question

We've decided that we won't be working on this project. Sorry to all the people who were in favour of it.

[Related: Two factor authentication for Stack Exchange]

So, over the last couple of weeks, I built a bare-bones two-factor authentication system for Stack Exchange OpenID. Currently, it only supports:

1. Logging in via Stack Exchange OpenID
2. Google Authenticator-style code generation
3. Recovery codes

It does not currently support:

1. Logging in via our sites, Careers, mobile apps, etc.
2. SMS-based code generation or recovery
3. Any other integration with our sites

Before we ship this feature, we probably want to finish at least the site login/integration and SMS stuff. So the questions are:

1. Would people actually use two-factor authentication for Stack Exchange OpenID if we completed this feature?
2. What other features should we implement before this would be considered a completed two-factor authentication system?

Your input will help us determine whether to continue with the project or shelve it. :-)

Answer 1

I believe that I agree very closely with Tim Stone and that the proper thing is to do this because it's the right thing to do for security. We should be encouraging proper behavioral practices. StackExchange OpenID is almost certainly used solely by developers (who has stats and magic, I would love to know how many non-techies use the SE OID endpoint for login) or other highly-IT savvy folks, and I believe that if we want the majority of developers to adopt certain features, it is the responsibility of organizations like Microsoft, Google, Apple and StackExchange, resources that we all love and adopt madly, to support proper behavioral patterns.

I get that this is likely to be a low-used feature, and I get that it seems like a giant waste of time, but I believe it is the right thing to do. StackExchange has always been about building the right tools for the community, and not about chasing pipe dreams.

If the choice is between 2FA and more April Fools jokes, I want 2FA. If the difference is between 2FA and a better revamp of an existing feature (hello vastly improved profile pages) then I would need to hear what the other feature is.

In direct contravention to https://meta.stackexchange.com/a/256768/146986 (which I upvoted) I think that this isn't about "what are people protecting with their login" because I have 2FA on Facebook and Google and I use those to login to sites I don't care about. I want the OpenID endpoint to be secure so that it doesn't matter what site I use it for.

Full disclosure: I honestly don't use this endpoint for many other services, but not because I don't trust it, but because I have so many to choose from, and I just go for easy. But that's not to say that I think less of this endpoint. I definitely want it to be a great resource.

Answer 2

I would definitely use this feature if it gets added. In fact, I inquired about this feature in the past from this post here.

I disagree with the sentiment that 2FA is only about securing valuable data. Having had my bitcointalk account hacked in the past and the lax security attitude by the mods and administrators that run that forum, I make it a habit now to always use 2FA where possible.

For me it's about safeguarding my rep and my own participation in SE -- the last thing I would want happen is a malicious actor getting access into my SE account and wreaking havoc to my online identity. Any 2FA mechanism you can add to make their jobs harder is a good thing.

The main argument against adding 2FA is that it creates more friction for the user during login. But this is a solvable problem; instead of implementing your typical 2FA implementation, as done by so many other sites, just use Clef instead. This gives you the benefits of 2FA without any of the login friction -- if anything it will make logging into SE even easier.

Answer 3

This question really depends on what sites people are using to log into with using their Stack Exchange OpenID accounts. I'm going to assume most are just using it for SE network sites and is the basis of my following thoughts:

Seems to me two-factor is really about securing valuable data (bank, email, etc). I'm not really sure that stack exchange stuff fits that category. If someone were to gain access to your account, what are the worst things they could do? In most cases, pretty benign thing (mess up your rep, get you reported, etc) that could be appealed once found out.

I would say of all the sites, the only one with potentially a bit of sensitive information is Careers. If the information there is sensitive enough to warrant 2FA from any OpenID provider, I would say it makes sense for the SE OpenID provider to implement it.

That said, I probably wouldn't use it, even with Careers, because I consider the risk pretty low for me.

Answer 4

Will usage of 2FA be configurable by the users? I think this will solve a couple of the problems others have mentioned.

No. Too complicated for me. – bjb568 13 hours ago

Should be upvoted a thousand times. 2FA is a drag on productivity and will discourage users. – Deer Hunter 5 hours ago

I've noticed other site(s) have implemented this, and to be honest, in most cases I see it as nothing more than a "phishing" attempt to grab user's phone numbers. Like one site I know of, had this as "optional" before when creating a new account. But now they won't let you create a new account without giving a valid phone number. Ok, so I don't use them anymore. I don't think SE would make this mandatory but you never know the future. Sure, if SE had like "money bounties" and such, it'd be a nice optional feature, but don't see much point in it right now. – Roombatron5000 11 hours ago

By having it configurable and off by default (unfortunately), the work flow to sign up can remain unchanged. Existing users are also unaffected if they don't wish to utilize the feature. However, users that do want the additional protection can enable it.

I would utilize the feature. I am rarely required to log in to any of the sites on the network I utilize. The "inconvenience" of waiting for an SMS or an email to ensure I am who I say I am is negligible. As a moderator on one of the sites, it'd also be nice to know the extra layer exists.

Answer 5

I agree with Darren Kopp that there isn't a demonstrated need for heightened security, and I wouldn't use it.

Furthermore, I think this feature will inhibit casual use of the sites. Inevitable, some of new users will set it up just because it's there, and security is good. Then they'll be less likely to log in from another computer because of the hassle. I know I'm avoiding logging in to the sites for which I have set up 2FA, unless it's necessary.

Answer 6

I would use it. We should get in the habit of enabling 2FA on every site. That should be the norm for every site to enable 2FA, U2F and HTTPS at some point. I understand that it is not a feature to add at the beginning but not adding it at all (especially for site this big!) is a mistake to say at least.

Answer 7

If Stackexchange ever implemented 2FA such as U2F , Time-based OTP or other similar solutions I would gladly use it! I agree with Tim Stone that if increased security is not reason enough, then it should probably be admitted that there is no real need for use of any strong passwords at all for SE OpenID.

I also agree with jcolebrand in that we should encourage good behavioral security practices and not let it be dependent on what kind of information you are trying to protect. I'm starting to take 2FA for granted and whenever I have to create an account on a site that doesn't support it I'm a bit hesitant and get the feeling that they don't really care enough about my security.

As much as possible I prefer to keep separate accounts for each individual website I register to mostly because I don't want to have my whole online identity tied to one provider like Google. Thus I do not see the alternative to use another provider such as Google to get 2FA as a good solution at all. I enjoy my freedom of choice and would very much like the opportunity to be able to utilize SE OpenID with atleast as good security as if I would have used another OpenID provider.

Answer 8

My current use of 2FA is mainly my gmail account. For the moment, it is my go to OpenID provider I use to log on multiple other sites. Why do I still keep on with it:

1. It has 2FA, which is an additional layer of protection for this single point of failure.
2. It is recognised by other site as a "default" OpenID provider

I agree that for protection of StackExchange accounts, this might be a bit overkill. However, it's a real added value for protection of an OpenID account used in many other sites. So I guess, implementation of the 2FA for SE is a question of what do you want it to be.

Answer 9

For me personally, I don't really bother. I wouldn't use it.

For me this is on the 'could have' list, and there is a lot more that could have the attention of the development team instead of this feature that gives a nice show-off, but doesn't really add value.

Answer 10

I would use it

I suggest by default to not activate it on new accounts. So that only interested users could opt-in.

I would be happy to contribute testing