Welcome to Codidact Meta!
Codidact Meta is the meta-discussion site for the Codidact community network and the Codidact software. Whether you have bug reports or feature requests, support questions or rule discussions that touch the whole network – this is the site for you.
Can we have second-factor sign-in authentication via e-mailed one-time codes?
I realize that this might be a bit of a niche use case, but I'm going to put it out here anyway.
The availability of 2FA via an authenticator app is a great boost to account security.
However, there are still people who don't have smartphones, or who might not be willing to tie their smartdevice to their account here for some reason. For a not entirely unreasonable example, their smartphone might be a work-provided device where policy restricts what it can be used for.
I don't expect that this would be at the top of the list of priorities by any means, but since Codidact can already send e-mails (see for example the subscription feature), would it be possible to have second-factor authentication via an e-mailed one-time code?
I imagine that when set up, after successfully authenticating with one's password, an e-mail would be sent to the address associated with the account, containing a short code that must be entered before being signed in, and that this would happen each time the user signs in (not just when the attempt looks "suspicious" according to some metric – I suspect this would make the feature easier to implement).
Having that would mean that an attacker would need to gain access both to one's Codidact credentials, as well as one's e-mail account; and that such access would need to be ongoing (unless the attacker turns off the sign-in code requirement, which the legitimate account holder would notice no later than the next time they sign in and aren't prompted for a code).
2 answers
You are accessing this answer with a direct link, so it's being shown above all other answers regardless of its score. You can return to the normal view.
Please make sure that such a feature is optional, and not the default when you create your account.
Personally I find such extra security a pain in the butt and annoying. This isn't Fort Knox or my bank account. A user name and password should be good enough, without needing a phone handy, or immediate access to a particular email account, or whatever.
This should be completed with the next deploy. To make it easy, we just email you a link to sign in - same functionality, but easier to use.
1 comment thread