[hxkd]

Sounds good Omni! I hope it keeps hackers away.

hxkd

EDIT:
Sorry for LQP but I had to be the first person to post :).

[S70N3R]

Just say the users Secondary email is compromised?

[JrSadFish]

sounds cool. But a bit confusing.

[BaussHacker]

I thought there already was something like this.

Anyways, that's a good idea and I will look forward to it.

But I'm already secured like this, at least for my mail. As I got 3 emails connected to it.

[2buckz]

Good idea honestly - it'd work out perfectly.

[idonotcare]

Make a pin and a master pin.

Pin = Chaning password and e-mail
Master Pin = Changing master encrypted e-mail

[Chutiya hun mien]

What if a hacker still has access to some account and sets it up, the real owner is then fucked? Why not keep security questions? Just send the security question set up link to the EMAILS of current users so they are the ones who set them up and recover their accounts when ever they lose access to them.

[Etheryte]

Secondary email somehow being compromised, might be through other means, not through the site, e.g. the member getting infected, would thus result in the account being compromised permanently?
I fail to see how this is a perfect solution.

[Asatru]

That sounds like a really good idea and no I'm not ass kissing.

[Kōtei]

Will the secondary email be displayed in UserCP? Because if it is, someone that has access to someone else' account can simply find that email, then try to crack it or steal it, then they are fucked all the same.

[SavageBoys]

Sounds about right to me.

Use an alias/fake address/fake DOB then screenshot the info and save it to a flashdrive.

Then make two txtfiles one with the pass and the other with the email but instead of typing it IN the textfile put the info as the name and rename the extension .password and .email and place them on said flashdrive.

At least thats what I did.

Can't steal info from a piece of hardware thats not connected.

[Morchid]

Seems to be a great idea. Hopefully we don't have to deal with this security problems again :)

[PhirewireNET]

Honestly if you are gonna implement this, i would have the secondary email something from you;

Hackmail.net or something; have it so you can't change its password or anything and it has to be attached to hackforums email.

[.[Preservation].]

I think the secondary email is close to flawless, if implemented in the account creation process. I'm not sure how hard that would be to implement, but it would protect new members quite well.

To everyone asking what would happen if the secondary email was compromised. First, I would imagine that this email would ONLY be used for this purpose. If a hacker we're to aim at hackforums, or more likely a specific member and got a keylogger or a rat onto the member's computer it wouldn't do them any good, as the user would never access the email. Second the database was hacked again, they would just have email addresses they couldn't do anything with.

Just my two cents.

[wia]

Just hash the emails next time. If you don't mass mail no problem. A second email is silly because if your second email get's compromise or you lose access you can't change it.