This is a very good feature in the protection of the forum users. But I have not really gotten the idea to use the 2fa. I tried to enable the feature but it is not working yet. But I will give a try again in next time. And if really the code expired too soon then it will affect many users because in most time network is not good and whenever the network is bad by delaying to receive the OTP then person will be repeating himself to resend the code for several time. But if the code expires within 50 minutes then it is good because within that period the code must have arrived.

Another feature we need is the forum notification feature. Thanks theymos and PowerGlove.

Well, that was actually great news, I mean it was discussed here in the forum for a long time already and many members want another layer of security here in the forum. There are obviously some cases of hacking here in the forum where the Bitcoin address staking works fine as a layer of security when it comes to recovering your account. Probably the last thing that you could do in order to recover your account in case your email is already compromised, I mean that would make sense if the 2FA doesnt provide any protection on compromised emails.

Anyway, It was working great and fast, but didn't really use it since I'm always stay login on to my desktop computer, but added layer of security is welcome since it is going to be useful in the future in protecting accounts.

Thank You  PowerGlove,theymos  

When FIDO2 ?

(Thanks for letting me work on this, and for the valuable tweaks and additions that you made.)

Hmm... That's a good question. A type="text" field would make it easier for people to see if they've typed in their OTP correctly.

I erred on the side of caution with a lot of the decisions I made with this patch. I think the rationale I used (just guessing, I don't actually remember) when deciding on a type="password" field went something like this: I left theymos some configuration knobs in the code, and I didn't know exactly what values he would settle on. So, as a hedge against him settling on a very long OTP validity-time (like a few minutes or more, instead of ~30 seconds), I thought it best to treat the OTP as password-like (and prevent it from being easily shoulder surfed). That was the thinking behind the OTP field-type on the login page. The thinking behind the OTP field-type on the settings page was just to mirror the field-type from the login page.

If that becomes a problem and more than a few people bump into it, then it's very easy to adjust.

@theymos: If you want to make the OTP codes remain valid for a little longer, then adding 1 more 30-second window of look-behind would be a good start. (Changing the look-behind value near the top of TOTP.php won't affect the otpauth URI, so it won't affect compatibility or disturb anyone's already-imported settings.)

---

Thanks for all the congrats & stuff being left in this topic. Bitcointalk has become a lot more important to me than I expected when I joined. I'm grateful that I get to contribute to it in my own way, and I hope to keep doing that for a good while yet. Cheers!

Thanks @Theymos & special thanks to @PowerGlove for added 2 factor Authentication.
Adding this two factor authentication has added more security to the forum. This is a gift to all of us from the forum admin on the occasion of Christmas. We will get more security when we login to our account, this is actually a kind of new direction and addition for us. Looking forward to more updates in the future and hope that our forum will continue to grow.

Excitement regarding implementation of 2FA authentication for forum login is quite understandable, though, frankly,   the type chosen, i.e. OTP is obsolete already. Much easier and at the same time more stronger would be the use of U2F key, but, sorry to say this,  probably one need to wait the next 10 years to witness this authentication technique here.

Nevertheless, thank you both, theymos and PowerGlove, for the step forward.

It somewhat limit security offered by 2FA, but i guess we could just set 2FA on our email address.


And that's just how app-based 2FA usually works.


Could you explain how mandatory 2FA leads to less alts? After all, it's app-based 2FA.

I doubt different email solve when you could just use plus feature like this,


In addition, email forwarding service let you generate "unlimited" email address such as https://www.33mail.com/.

Finally! We had this conversation 1 week ago and it's here. One could argue that my ranting contributed 1% out of the remaining 10% 

Time for the champagne gentlemen?

Haha, we are busy people and have many other things to do like saving the earth from aliens, hahaha, but if we compare this forum with others then it is still doing great and giving a good competition. I think the improvements of this forum are solely made by the local community like free lancer without any pay. I hope PowerGlove will be paid by the Admin. haha.

By the way, it is a good thing and we needed, it I am definitely going to use it but what actually the usage of that QR code and the address they have gave us?