Two Factor Authentication

[wiscoaster]

I'm sorry, but if you make two-factor authentication mandatory, you will lose me. Two-factor authentication is a freakin' pain in the arse, and since I know I'm cautious enough to protect myself as much as is necessary already, it's an additional (and onerous) additional level of protection I don't want and don't think I need. Two-factor authentication should be an option, not a mandate.

I suspect those members that have been harmed wouldn't have been spared by two-factor authentication.

 

[Alkali Ike]

I’m fine with 2FA but I beg you to let members voluntarily provide a phone number so the verification code can be sent via text. This works perfectly for both desktop and mobile. Well at least on Apple devices.

 

[Mr_McBride]

I’m fine with 2FA but I beg you to let members voluntarily provide a phone number so the verification code can be sent via text. This works perfectly for both desktop and mobile. Well at least on Apple devices.

Until your phone breaks or the battery dies, etc

 

[wiscoaster]

You would feel differently if the mods were not banning hacked accounts and scammers......

I've been a moderator, lead moderator, administrator, and forum owner. I know what goes on behind the scenes. Two-factor authentication will not be a solution to the problems the staff are posing. Only an additional burden to members. It should be their choice.

 

[Parzival]

Do we really have to do this every time we are away for more than 30 minutes?

At my work I deal with sensitive data and we only have to do it once per day.

 

[paul]

Yes. Obviously one code a month is easier that a text every time you want to use the site. @paul please let us know if the email is OK, or if it is recommended to use text.

email is definitely ok. Sorry I’ll change the wording and post an instructional thread later tonight. I put the cart before the horse and I apologize .

I’ve been using email codes on TB for several years now.

 

[Parzival]

It involves entering a code emailed to you, once a month.

Ok, I thought it said 30 minutes. But, it’s already made me go through it twice in the last few hours. If it’s truly 30 days, I’m ok with that.

 

[paul]

I've been a moderator, lead moderator, administrator, and forum owner. I know what goes on behind the scenes. Two-factor authentication will not be a solution to the problems the staff are posing. Only an additional burden to members. It should be their choice.

I’m not going to debate security protocol, I’m sorry for the inconvenience but I’m acting in the best interest of TalkBass with the input of staff and mods here.

 

[paul]

Did we get a heads up on this? Now that it's been explained why, I don't mind, it just hit me when I went to login. My old man brain gets confused.

yes, I haven’t pulled the lever yet lol. It’ll be several days.

 

[Alkali Ike]

For TB, my devices display a checkbox that says “Remember this device for 30 days”.

I’d still prefer texted verification codes when needed though.

 

[Alkali Ike]

Until your phone breaks or the battery dies, etc

Or you get run over by a bus or any number of unlikely events. And it’s only required every 30 days on my devices.

 

[Alkali Ike]

But please facilitate texting.

 

[Mr_McBride]

View attachment 5340123

But please facilitate texting.

So, you have to set it up on every device you post from? Just to protect posting messages on a forum? That makes no sense to me.

YMMV

 

[retslock]

I guess I’m ok with it but I live in an area that has very poor mobile phone (cell to you) reception. So many vital sites are now using the mobile as verification which means I can’t get access to important info from government sites. The assumption that the entire population has a mobile phone and the benefit of good reception is unrealistic.
It will be email verification for me even though it may not be the preferred or most secure method.

 

[Bass Ape]

Is your mobile device connected to WiFi when you’re at your computer?

 

[ryco]

Paul's site. Paul's rules.
Simple as that.

 

[Alkali Ike]

Confirming your identity once a month!? Totally yo like bananas!

 

[paul]

I've re-written the announcement and created a post here with more info: https://www.talkbass.com/threads/two-factor-authentication.1639251/

Sorry for the confusion. Emailed codes are perfectly fine and it's a 30-day counter for having to re-enter the code. More authentication options will be available in the future, as well as hopefully an option remember your devices longer than 30 days.

 

[FunkHead]

I am fine with it. Email is always at my fingertips. It's better than having accounts hacked.

 

[paul]

More authentication options will be available in the future, possibly including sms text. Emailed codes are more secure however

As for the reasoning behind this please see this new post: https://www.talkbass.com/threads/two-factor-authentication.1639251/

 

[roccobass]

It's no skin off of my teeth to have to do the two part authentication. Trust me, I'm a techno waldo and even I figured this out. I'm one who's usually griping about extra this and that on websites and since the authentication is good for 30 days, it's good enough for me. I'm ok with it, especially if it means keeping costs down here.