2FA configuration?

[G3nt00]

Hi,

I miss 2 factor authentication, or have I just not looked thoroughly enough? If not yet, is it planned? If not, why?

Thanks

[NeddySeagoon]

G3nt00,

Hardware keys work. What did you have in mind for a second factor?

Anything any other distro can do, Gentoo can do too.
You only need to tell it how. Someone has to be first, if its you please contribute a Wiki page.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[G3nt00]

[NeddySeagoon]

G3nt00,

The forums do not support 2FA. The code base in use is phpBB-2.0.23 from 2002.
Maybe phpBB-3 will?
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[G3nt00]

[NeddySeagoon]

G3nt00,

I don't think it will happen until -infra are forced to update the php version that the forums depends on.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[szatox]

Not until its bits rot to the point it starts falling apart under its own weight

[pietinger]

[G3nt00]

Ah. I hear you. However I don't feel security is the strong-point here... I am not suggesting keeping everything top-notch all the time, but this is a somewhat big thing. If I'm not mistaken I also think this grand system cut my wanted password in half more or less. But true; "If it ain't broke, don't fix it..." + "Unless, there is anything to gain from it." which there seem to be here. Keeping my hope up for it anyways. Who should I nag about it? (kidding)

[Hu]

There was an attempt a few years ago to upgrade. I think it was never formally abandoned, but as you can see, neither has it been completed. I do not recall specifically why it is not done yet, but I suspect the issue is that the key volunteers are swamped with other higher priority tasks.

[G3nt00]

[szatox]

[G3nt00]

[Hu]

Although szatox's tone was flippant, the point is sound. Before you can argue that security is too strong or too weak, you must define your threat model, so that we can discuss whether the proposed security is appropriate to counter the perceived threat (which includes discussing whether the perceived threat is realistic enough to justify the proposed security).

To elaborate on szatox's point, I see these things as being "of value" in stealing an account:

• Ability to post as that user, leveraging that user's reputation to potentially mislead others
• Ability to deface prior posts by that user
• Ability to read that user's private messages
• For privileged accounts, ability to use that privilege to deface posts by other users

These forums are readable anonymously and allow pseudonymous registration, so stealing an account has no value to someone who merely wants to read public posts here. Of those things of value, about which are you concerned? Who do you envision caring enough to bother stealing an account here? Your account is currently not privileged, so the last bullet point does not apply to an attack on your account.

I can recall only one account theft in the time I have been attentive to such things. It was never confirmed as a theft, but was suspected as such because a previously inactive account became active and started spamming, despite historically having been a legitimate contributor. The most likely explanation is that the legitimate owner lost control of the account, and the thief began abusing it to spam.

[G3nt00]