Two-factor authentication is here!

Today, I added an optional feature to keep your accounts more secure: two-factor authentication.

Right now, if someone guesses your password and has your email address, they can get into your account. Financial institutions and other sites that are serious about your account's integrity have added two-factor authentication, which requires you to verify your identity through a third-party app in order to access your account.

It's active now, but entirely optional. If you would like the security, you can go to your settings page and click a link to get started setting it up. I have it active on my account now, and have tested it and found that it works smoothly.

For more information on how to set it up with your account, see the site's help page:

https://www.honestgamers.com/users/help/topics/how_do_i_protect_my_account_with_two_factor_authentication.html

Most of you shouldn't need two-factor authentication, and will probably prefer not to use it. But if you want to, now the option is there.

Two-factor authentication: it's not just for banks and web apps anymore!

App only? No use for those of us without a smartphone then. Not much of a loss since, as you say, most probably won't bother with it here, but regular e-mail 2FA works for everyone (well, unless e-mail doesn't work, as is the case for outlook.com just now).

The two-factor authentication implemented uses standard TOTP, which works with desktop programs and browser extensions also. For example, the Authenticator extension in Chrome, Edge, and Firefox should be compatible, or a free program like KeePassXC. That was part of the appeal.

If someone steals a device such as a laptop that has everything in one place, the added protection is weaker than using a separate phone for authentication. After all, they'd potentially have access to your email at that point. Any accounts tied to it would be just a password reset request away. If someone gets into your email without your device, though, 2FA at HonestGamers means a password reset is only half the key that gets a person into the account, and they wouldn’t be able to succeed without the code.

Of course, if someone steals your laptop, you're probably worried about more pressing matters than whether they can access your HonestGamers account. There's no perfect solution that covers everyone, but this process is an extra precaution that wasn't available before.