Hey HN,<p>Been thinking about account security and noticed that Hacker News still doesn't offer any form of 2FA (Two-Factor Authentication).
Given the tech-savvy community here, it seems surprising that we don't have this extra layer of security.<p>TOTP (Time-based One-Time Password) would be a great option to start with, considering its balance of security and convenience.<p>So, I'm curious:<p><pre><code> * What's the hold-up with implementing 2FA, specifically TOTP? Any technical hurdles or other considerations?
* How important is 2FA to the HN community?
</code></pre>
Seems like a no-brainer to add 2FA and beef up our account security. Thoughts?
I would honestly expect the HN crowd to be using long complex passwords. That's probably sufficient for this type of site. I guess only dang could say if HN has been having challenges with account take-overs. I never hear about it. I would not mind having the option to restrict my login to a CIDR block however. I am personally not a fan of adding third party authentication unless it is entirely self hosted and the code is reviewed by teams like NCC.<p>For banks and some DNS registrars I use IP restrictions in addition to whatever 2FA <i>usually SMS</i> they support along with challenge questions. Additionally for banks I make most of my accounts read-only from the internet. IP restrictions are a feature their support team dislike as many people think they have a static IP when they do not.