+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+---- Forum: Suggestions and Ideas (https://hackforums.net/forumdisplay.php?fid=134)
+---- Thread: Require 2FA to disable 2FA (/showthread.php?tid=5209610)
Pages: Pages
1
2
Require 2FA to disable 2FA - minimalist - Mar 20, 2016
Title says it all. Would help protect against hijacked accounts, but it would also prevent users from recovering their accounts with saved sessions in the case of a lost phone.
* - Incognito™ - Mar 20, 2016
That is the one thing I was always scared about, was having this day come.
I'll for sure lose my phone then gg HF.
* - minimalist - Mar 20, 2016
(Mar 20, 2016 11:18 AM)Incognito™ Wrote: That is the one thing I was always scared about, was having this day come.
I'll for sure lose my phone then gg HF.
Should not you just switch over to Authy if that is a concern?
* - Elijah Mikaelson - Mar 20, 2016
Indeed , I agree with this. I log out of HF every time I get off my PC to prevent account jacking if I had a virus.
* - Incognito™ - Mar 20, 2016
(Mar 20, 2016 11:18 AM)Minimalist Wrote: Should not you just switch over to Authy if that is a concern?
I have authy was un aware there was another way to get a 2fa code besides the phone?
* - Cryptic™ - Mar 20, 2016
(Mar 20, 2016 11:24 AM)Incognito™ Wrote: I have authy was un aware there was another way to get a 2fa code besides the phone?
Authy has a desktop application and a chrome extension.
* - Mr Kewl - Mar 20, 2016
(Mar 20, 2016 11:18 AM)Incognito™ Wrote: That is the one thing I was always scared about, was having this day come.
I'll for sure lose my phone then gg HF.
(Mar 20, 2016 11:24 AM)Incognito™ Wrote: I have authy was un aware there was another way to get a 2fa code besides the phone?
[Official] Gauth/2FA Backup
WRITE DOWN YOU CODE! OMG!
* - Incognito™ - Mar 20, 2016
(Mar 20, 2016 11:33 AM)Mr Kewl Wrote: [Official] Gauth/2FA Backup
WRITE DOWN YOU CODE! OMG!
Alright god, I tho robots couldn't yell..
* - minimalist - Mar 20, 2016
Bumping for visibility & more feedback.
* - Bill Kapri - Mar 20, 2016
Pretty sure Chrome has an authy app???
* - minimalist - Mar 20, 2016
(Mar 20, 2016 04:35 PM)2.15.19 Wrote: Pretty sure Chrome has an authy app???
It does, but some uninformed/unintelligent users stick with the no-backup Authenticator app...myself included.
* - Bill Kapri - Mar 20, 2016
(Mar 20, 2016 05:43 PM)Minimalist Wrote: It does, but some uninformed/unintelligent users stick with the no-backup Authenticator app...myself included.
Ah, that makes sense lol when i set it up i decided that i'd lose my phone before my computer, therefore it makes sense to set it up on PC instead.
* - Armada - Mar 20, 2016
I admit I am a gambling type of man, if my acct get jacked, Im FUBAR, I could email Omni and lead me case, and I likely would but truth be stated, I am AWARE of my risks.
IF I get fucked, its my own liability. No one elses.
Its one hell of a risk, to which I dont think is worth, I have protected layers already, use common sense...
* - Omniscient - Mar 21, 2016
Quote:Title says it all. Would help protect against hijacked accounts, but it would also prevent users from recovering their accounts with saved sessions in the case of a lost phone.
I will be adding more protections and tools to Trust Scan asap.
Also the problem isn't hijacked accounts. That's just what people are telling you after their account is used to scam. These are shared accounts to split exit scam profits. Notice how often these accounts are those who just walk away without complaint after their account is closed? These are not members who are activate making money in the Marketplace so they just burn the account. It's appealing they can leave HF and earn anywhere from a couple hundred to even possibly a couple thousand.
I manually recover all lost 2FA accounts, I even added a contact form subject specifically for it. Those with lost 2FA but are still within the same ISP and IP location can have it disabled by me manually. I check to ensure the account is indeed theirs. And I also reserve the right to RKO the account just in case I'm not 100% sure it's the original account owner. So far these policies have worked.
Also unfortunately members are NOT using the latest addition to Trust Scan page very well. The "Last Gauth/2FA Validation" date is highly important and if used in these recent scams would easily have prevented it.
The greed of members willing to get a deal done without showing caution is the exact reason scammers are here. I continue to add tools that are ignored and proper caution isn't shown. That's very frustrating to me personally as I spend a lot of time on this.
Quote:Should not you just switch over to Authy if that is a concern?
Or write down the key, which is the instructions on Gauth page when you activate it. Even if your phone is lost if you've retained the key code you will be able to activate another device without problem and sign-in again. It's the exact same thing as having a backup code.
More options for security are coming just as they've been coming over the past year.
Quote:IF I get fucked, its my own liability. No one elses.
That's NOT acceptable. Because if you get fucked they will take your account and steal money from other members in the community. So it's not just you.
* - Armada - Mar 21, 2016
(Mar 21, 2016 04:38 PM)Omniscient Wrote: That's NOT acceptable. Because if you get fucked they will take your account and steal money from other members in the community. So it's not just you.
I simply meant in either case or event, It is me who would and should be held liable for any damages. It is after all my responsibility to maintain and keep my account secure.