Two-Factor Authentication (2FA) - Comments & Questions

[gerryvz]

Continuing to see NEXT TO ZERO scammers / spammers registering for the forum since implementing two-factor authentication.

One or two have slipped through, but that is because they have actually gone to the effort to manually register through the whole process.

I'm feeling increasingly good about the decision to move to 2FA and the positive effect it's had on things, in terms of undesirable people registering and trying to scam or spam our membership.

 

[R129 UK]

I’ve just renewed my login requirements without any issue but I have a question:

When you are effectively logged out by the timed reset, do you still receive email notifications of thread replies and DMs etc?

 

[gerryvz]

I’ve just renewed my login requirements without any issue but I have a question:

When you are effectively logged out by the timed reset, do you still receive email notifications of thread replies and DMs etc?

You should, yes. Email notifications (per your preferences) are a completely different process than login authentication, which is the only thing that 2FA pertains to.

 

[gerryvz]

Continuing to see NEXT TO ZERO scammers / spammers registering for the forum since implementing two-factor authentication.

One or two have slipped through, but that is because they have actually gone to the effort to manually register through the whole process.

I'm feeling increasingly good about the decision to move to 2FA and the positive effect it's had on things, in terms of undesirable people registering and trying to scam or spam our membership.

I spoke too soon on this, as a scammer manually registered and posted DOZENS of scam messages in the WANTED sub-forum. Fortunately @Glen caught this within a few hours, and all was deleted and the scammer was despatched straightaway.

This will continue to be an annoyance, as individual human scammers/spammers will continue to work the system and register manually to do their deeds. Essentially, there is zero defense against this, unless there are thresholds set for new members to post.

We already have thresholds set for new members to send direct messages, but doing same for posts for new members makes the forum quite unfriendly to new members -- something I'd like to avoid.

Given the current rarity of humans making the effort to register, confirm and post (as opposed to automated efforts to get around countermeasures), I'm willing to accept the one scammer/spammer manually registering (or so) every month or two.

 

[maw1124]

Following up on this - we have definitely seen a reduction in fraudulent activity since implementing the two-factor authentication schema.

Only a single spammer has registered, and he was 100% manually registered, so he took a lot of time and effort to do so. Only to have our "automated" forum countermeasures reject his attempt at a first post.

Otherwise we haven't had any further accounts hijacked, nor have we had any spammers/scammers try to fleece people.

With just a couple of exceptions, folks seem to be working with the 2FA just fine, and it hasn't caused much in the way of problems.

Happy to see this 2FA step -- delayed as long as it was -- has improved the quality of forum life for everyone.

So far.

How often should we expect to see this 2FA process?

maw

 

[R129 UK]

How often should we expect to see this 2FA process?

maw

Every 30 days:

Two-Factor Authentication (2FA) - Comments & Questions | Announcements and Admin

This thread is here for forum members with questions or comments about the upcoming "two-factor authentication" schema, to get answers or information as necessary. Feel free to fire away! Thank you 500Eboard Administration

www.500eboard.co

 

[maw1124]

Every 30 days:

Two-Factor Authentication (2FA) - Comments & Questions | Announcements and Admin

This thread is here for forum members with questions or comments about the upcoming "two-factor authentication" schema, to get answers or information as necessary. Feel free to fire away! Thank you 500Eboard Administration

www.500eboard.co

Yeah I'm seeing it every other day...

maw

 

[ace10]

Got a notification on another car forum. This is a new one. Can't be solved with any security tools, either.

 

[r44raven]

I have a friend who opted out of membership of this board, because for various reasons he found the two part authentication difficult. At the time, I believe his membership was "disabled". He is now trying to rejoin, but gets a message "name already in use". I am not tech savvy - he even less so - so csnnot help him! Can anyone give me any pointers as to how he can renew his membership?

 

[R129 UK]

I have a friend who opted out of membership of this board, because for various reasons he found the two part authentication difficult. At the time, I believe his membership was "disabled". He is now trying to rejoin, but gets a message "name already in use". I am not tech savvy - he even less so - so csnnot help him! Can anyone give me any pointers as to how he can renew his membership?

I assume it’s this person?

Probably contact the admin who posted:

Post in thread 'Two-Factor Authentication Comments & Questions'
Two-Factor Authentication Comments & Questions | Announcements and Admin

 

[r44raven]

Your request has been granted, and your account has been switched to "Disabled" status.

If you ever desire to come back to the forum in the future, your account can be re-enabled.

Thank you for your past participation and contribution.

This guy is trying to re-establish his membership, but gets the message "name already in use". I'm not tech savvy - he even less so - is there any advise I can give him so he can rejoin the board?

 

[gsxr]

This guy is trying to re-establish his membership, but gets the message "name already in use". I'm not tech savvy - he even less so - is there any advise I can give him so he can rejoin the board?

We may need assistance from @xfadmin to correct this. If he already has an old/existing account, that account can be re-activated, no need to create a new one. But he might not be able to do this himself.

 

[Glen]

Who is it? What screen name?

 

[xfadmin]

The account has been re-enabled.

He needs to set up two-factor authentication and direct the code to be sent to his e-mail address, rather than a phone authenticator app. This is clearly shown in the instructions.

This is all very clearly shown in the instructions, which should be accessible by anyone -- member of the forum or not.

FYI - HOW-TO: Logging In With Two-Factor Security Authentication (2FA) | Announcements and Admin

As you probably know by now, due to several established members' accounts being hijacked, forum management has decided to implement additional security measures in the form of "two-factor authentication" or 2FA as it is commonly known. This means that you will, periodically, be required to...

www.500eboard.co

Perhaps @The Emperor can inquire as to why he wants to re-activate his membership here.

 

[ace10]

Perhaps every action on this forum should require a two-step confirmation?

 

[r44raven]

The account has been re-enabled.

He needs to set up two-factor authentication and direct the code to be sent to his e-mail address, rather than a phone authenticator app. This is clearly shown in the instructions.

This is all very clearly shown in the instructions, which should be accessible by anyone -- member of the forum or not.

FYI - HOW-TO: Logging In With Two-Factor Security Authentication (2FA) | Announcements and Admin

As you probably know by now, due to several established members' accounts being hijacked, forum management has decided to implement additional security measures in the form of "two-factor authentication" or 2FA as it is commonly known. This means that you will, periodically, be required to...

www.500eboard.co

Perhaps @The Emperor can inquire as to why he wants to re-activate his membership here.

Thanks for your help. I have passed the information on to the member involved. As far as to why he now wishes to rejoin, I genuinely think he missed the "board". I'm sure he won't mind me saying that he is a bit of a luddite (as am also I in some respects !), and in a world becoming more and more dependant on (often unreliable) tech, the thought of having to take on board a two stage authentication process was just too much?

 

[R129 UK]

Thanks for your help. I have passed the information on to the member involved. As far as to why he now wishes to rejoin, I genuinely think he missed the "board". I'm sure he won't mind me saying that he is a bit of a luddite (as am also I in some respects !), and in a world becoming more and more dependant on (often unreliable) tech, the thought of having to take on board a two stage authentication process was just too much?

If you or Paul need any help or advice etc just message me and I’ll help you gentlemen out if I can.

 

[xfadmin]

Continuing to see NEXT TO ZERO scammers / spammers registering for the forum since implementing two-factor authentication.

One or two have slipped through, but that is because they have actually gone to the effort to manually register through the whole process.

I'm feeling increasingly good about the decision to move to 2FA and the positive effect it's had on things, in terms of undesirable people registering and trying to scam or spam our membership.

The two-factor authentication seems to be working, as far as keeping most all scammers off the site.

We have only had a couple of scammers/spammers since implementing this 2FA protocol on January 9th, and those have been individual people who have manually registered and even gone through the 2FA setup for their accounts.

Sadly there is not much that can be done with folks who are determined to expend the time and effort to register manually and jump through all of the hoops to do so. But fortunately the 2FA has stopped the rest, which is great. Our automated, multi-layer countermeasures also reject many registration attempts based on the spammer's name, IP address, and registration e-mail address -- often rejecting them immediately before they can complete the registration process!

So, the 2FA system -- despite the occasional inconvenience every 30 days when you need to re-up your second factor -- has been a good success so far.

 

[stickyvicky]

Hi! I'm not able to Dm but if you could reach out to me in regards to 2FA, that would be great as I'm having some issues. Thank you.

@xfadmin