[Omniscient]

This is a warning and a notice to members that if you use the same password you have on HF as any other forum you are risking not only your account but also that if you're compromised the account will then be used to scam members.

In the past year at least one competing site had their database breached multiple times. Recently someone is using that database to do attempts at logging into HF accounts. If that database has the passwords cracked and you have the same login to HF (email+password combo) then it's possible they can log into your HF account if you don't use 2FA.

To prevent danger to the community please ensure the following.

1. 2FA is enabled
2. You use a unique password to HF.

So play it smart and make good choices in your security. Thanks.

[Who Soup]

People need to just enable 2f already, best invention since sliced bread

[Nas]

I know you gave us a lot of features to protect our accounts but I’m not sure if this would be a good idea where if someone logs into their account with an unusual IP they have to do an email verification.

I know a lot of big sites are doing that so not sure if HF already has something like that in place.

[RIP Juice WRLD]

2FA should really be common sense ...




(omw to activate it)

[Eagle 95]

I'd like to add that please, if you're going to use 2fa, don't be an imbecile and not backup the 2fa code. Write it down on a piece of paper and/or on notepad and transfer it to an usb for storage. This is for all sites you give a rat's ass, not just HF.

Also for passwords, if you're having difficulties to remember many passwords as you think you might have enough important websites, please use a password manager. Some I'd recommend is Dashlane, KeePass, Lastpass (had a breach but they should be ok by now), etc.

[SIM-74411]

Thanks for the heads up. Are you sending Important site announcements on discord? I will have to connect my account if that is the case.

[tux1]

Thanks for the heads up! I would of hoped that most people used a unique pass amyway haha

[Bacardi Cola Lime]

Thank you for letting us know. I use 2FA but I’m going to change my password as well!

[Temp_reassign]

I know you gave us a lot of features to protect our accounts but I’m not sure if this would be a good idea where if someone logs into their account with an unusual IP they have to do an email verification.

I know a lot of big sites are doing that so not sure if HF already has something like that in place.

Why do I feel as if you were asking for Omni to ban the use of vpn? However i know you mean well but still,  2fa activation should do the defense if someone was to have knowledge of your hf password.

[Skateboard]

When I first got my HF account it generated a unique password. And I've never changed my pass ever since, so, I still use the original password to log-in 👍

[Xerotic]

When I first got my HF account it generated a unique password. And I've never changed my pass ever since, so, I still use the original password to log-in 👍

Yes, we added the random password generator on the registration page sometime within the past couple of years. It's a quick optional tool to improve your security online.

[Sajuuk]

While I'll use 2FA, nothing beats a pen and pad for safely storing passwords. Those password managers have made me anxious for the years they've been around. If the passwords are on your computer, what's the point of storing them with any kind of encryption at all? Might be old fashioned, but the sh*t works. Because who the hell is going to bust into my place and steal a forum login?

[Semmenial]

Yes! Do the same with any other forum/website you register on.

[Nas]

Why do I feel as if you were asking for Omni to ban the use of vpn? However i know you mean well but still,  2fa activation should do the defense if someone was to have knowledge of your hf password.

No one said anything about banning anything, if you want to use a VPN just verify the login with the code you obtain from your email?
The fact is members are idiots and not all of them will have 2fa enabled so at least if an unusual IP is logging in it gives an extra layer of defense by forcing the intruder to attempt to login to the member's email to get the verification code. Which then they will face a roadblock from the email's provider's account security as well.

[Brаdley]

I'd like to add that please, if you're going to use 2fa, don't be an imbecile and not backup the 2fa code. Write it down on a piece of paper and/or on notepad and transfer it to an usb for storage. This is for all sites you give a rat's ass, not just HF.

Also for passwords, if you're having difficulties to remember many passwords as you think you might have enough important websites, please use a password manager. Some I'd recommend is Dashlane, KeePass, Lastpass (had a breach but they should be ok by now), etc.

With 2FA, I have saved the key and I downloaded it on my new phone, But have Authy downloaded on other devices. Everytime I use Authy on my new phone the codes don’t work and says “dirty code” but I go back into my old device and use Authy on it, and the codes work.

Not sure if you know the solution to this issue but it’s weird.