Hi everyone,
This thread will be outlining (potential) security issues and this thread is not supposed to bring down this site, but rather help it.
I feel as if my account is in danger. Not because I think y'all will be hacking it, but because if a targeted hack occurs on a specific account, then the account is most likely going to get wrecked, and slapped with a permanent ban when the hackers post crap on the forums.
I need to acknowledge that a good security measure has already been taken, which is the option to use 2FA.
But that just doesn't feel like enough to me. If someone knows your email's password and you use email 2FA, you're screwed. How about phone 2FA? Sounds neat to me, but if you get locked out because your phone broke, you're even more screwed.
I haven't tried either honestly. Mainly because I don't have the option to use phone 2FA. This is a personal issue and nothing that FCN can do about it. But rather serves as a reason to implement the following suggestions.
I suggest adding back-up 2FA codes (phone 2FA), which can be used to sign in. You can view them using your password, and re-generate them any time. Up to 8 backup codes, and each can only be used once.
And I suggest adding a PIN code that you can put on your account. This code is required to sign in to chat, and required to alter any account settings, as well as to make 1 post. Once the code is entered correctly, you will only be prompted once every time you log in. This should be ip-based. So say you're logged in and (somehow?) your IP changes, you'll be prompted again.
I also suggest adding a "Sign out of other devices" button. Say you're actually being hacked, you'll have a chance to kick them out and quickly add the above mentioned security measures.
Thanks,
LR x
This thread will be outlining (potential) security issues and this thread is not supposed to bring down this site, but rather help it.
I feel as if my account is in danger. Not because I think y'all will be hacking it, but because if a targeted hack occurs on a specific account, then the account is most likely going to get wrecked, and slapped with a permanent ban when the hackers post crap on the forums.
I need to acknowledge that a good security measure has already been taken, which is the option to use 2FA.
But that just doesn't feel like enough to me. If someone knows your email's password and you use email 2FA, you're screwed. How about phone 2FA? Sounds neat to me, but if you get locked out because your phone broke, you're even more screwed.
I haven't tried either honestly. Mainly because I don't have the option to use phone 2FA. This is a personal issue and nothing that FCN can do about it. But rather serves as a reason to implement the following suggestions.
I suggest adding back-up 2FA codes (phone 2FA), which can be used to sign in. You can view them using your password, and re-generate them any time. Up to 8 backup codes, and each can only be used once.
And I suggest adding a PIN code that you can put on your account. This code is required to sign in to chat, and required to alter any account settings, as well as to make 1 post. Once the code is entered correctly, you will only be prompted once every time you log in. This should be ip-based. So say you're logged in and (somehow?) your IP changes, you'll be prompted again.
I also suggest adding a "Sign out of other devices" button. Say you're actually being hacked, you'll have a chance to kick them out and quickly add the above mentioned security measures.
Thanks,
LR x
