You can also disable the cloud feature to maximize security, then simply keep an encrypted backup on your unhackable reel-to-reel tape based record system (which is what the government actually uses for nuclear secrets)

Sounds pragmatic, effective and easy to use. Ship it

Please don’t use the IP address. I use a VPN, and my IP is always changing (though I usually pick a US address).

I own customer identity management (CIAM) for a large telco. We added MFA last year, with it being mandatory for customers who have been compromised.

robin please include an SMS option in the final solution. It’s the most frictionless way to register and log in. SMS is more secure than email for OTP delivery. It’s much easier to hack someone’s email than to hack their phone (unless they use LastPass and MFA to secure their email account, as we all should). Contrary to some opinions here, I can’t get someone’s SMS messages just because I know your phone number. Unless they’re dumb enough to read the code to me when I call them on that same phone.

As someone who is a cyber security expert, Pinside should make 2FA available to anyone who wants it and I would encourage anyone to want it...

Jeff

Are you logging out regularly? I believe he said he would only run this check when you're actually trying to log in.

Good point, I usually don’t log out of Pinside.

I'm ok 2fa, as long as it's not Mandatory.
This isn't a banking app.

Sorry @robin, you got a down vote because your thinking of making this Mandatory.

I understand that you want to secure pinside, but this isn't the way to do it
If you want to secure the market place, add mandatory 2fa there
Do not add it for general usage

Probably a time to look into it. Since KLOV had two accounts compromised. Best close the barn door before the horse is gone.

LTG : )

Funny 2FA story. I called to cancel our health care spending account card today, because I lost mine. The representative asked me to respond to this:

“We’re sad that we lost him”

I racked my brain for about 5 seconds until I remembered that the answer was “Ronan” - our Corgi dog we lost 7 years ago.

Secret question / secret answer is about the silliest form of authentication there is.

I don't believe I've ever encountered that type of security question before.

I've always hated security questions, especially the ones where the question is forced without a custom option.

Weak security, and hard to remember since you can sometimes go years without needing them. And then at that point, they're wicked strong security measures

It was a custom security question. It seems open for abuse - I could make up a question like “What’s your wife’s favorite sex position?” (answer: “No”)

We can use Public Key Infrastructure (PKI) certificate authentication over SSH and implement RSA secure ID that generates a one time random number for all users. Pinside would validate the corresponding private key and map the authenticated identity to the user account. Next, we take a buckle mouth swab for DNA and map it into the profile for verification. Pinsiders could breath heavy or lick their screens and be verified also for true triple factor Harry Connic Jr authentication. Password resets could be mailed to remote location in Alamo, Nevada.

There goes all the liquid from my mouth

Was worth reading every other post in the thread to get to this.

I’ve been using MacOS “keychain” as a password manager for probably a decade. It’s already there on all my devices which are either locked with a Face ID or fingerprint.

Nice work! Thank you. This is a nice additional layer of security.

Some people (yours truly) still don't have cell phones, so SMS messages can be a pain. I do have a google voice number for this specific purpose, but some sites won't send text messages to those.

Holy cow! A new smartphone will change your life then.

Unfortunately, 2 factor is beginning to be more mainstream with a lot of sites now. For my work, its now required for email, 401K and time card entry. It gets a little more complicated because we cant bring cell phones in. This makes it tough to use 2 factor if we specified our work email for the random code and we are at home. I set up Google Voice to set up to call my cell also.

Not in a good way. I have a land line. Other than my mother calling once a month and the occasional call to the doctor or dentist to set up an appointment, I haven't talked on a phone in years. The only time I wish I had one is when I'm driving and have car trouble. I bought a new car a few years back, 250 miles from home, and it got a flat on the interstate 5 miles from the dealership. That was a helpless feeling.

Pretty much everyplace I go has free wi-fi and I always have wi-fi devices with me, so I can get online and do what I need to do.

Fantastic. Thanks a ton. I'm sorry you had to be pushed into this.

On the contrary! Sorry it took a scammer/hack to finally get me to implement this! After all, it only took me 6-7 hours to implement. I still hope to add optional phone/SMS codes soon.

Maybe I should also add it to notifications? You would get a push notification with the code. Probably faster than e-mail (and also free!)

I hate it.
How can I turn it off?

Log out, never return.

Problem solved for you.

Thank you for your constructive suggestion.
Hoping for some real information as to whether and how it can be disabled by account.

I like the idea and hope that there is no disable button. I like the thought that this would be a secure site to visit and not worry as much about the hackers.

My respect, admiration and appreciation for the work Robin does continues to grow by leaps and bounds.

Don’t expect constructive criticism from a guy who can’t secure his account and requires someone else to do it for him, lol.
6E0C6ECF-A4F8-4517-878A-C61D51628336.jpeg

I'm not in that world but I have a buddy that is, he works for a company that develops programs for machinery used internationally, they had some problems in Cuba (I believe it was Cuba) and so they sent a software engineer down there to help figure out what was going on. They've only got about 15 accounts, so one of their accounts is in Cuba.

The guy was supposed to be there a week, but when the week was up, the people involved with the company with the machinery with a problem, wouldn't let him leave the country. Basically they had a guy with him all the time and wouldn't let him fly back to the states. He ends up being down there a few months, they finally let him leave but kept his laptop.

So the guy quits as soon as he gets home, and either wouldn't turn over the software or didn't have the software, and now they have a 'client' in Cuba who still wants tech support, but they don't have a build of their software they're using to run the machines at the moment.

That's the craziest 'horror story' I've heard so far...

Considering that it is currently mandatory, there is no option to disable it.

The way of the world is that everything is moving towards 2FA/MFA solutions for online accounts so that they are more secure.

Yeesh. That is not ideal. Imagine how much they’ll have to pay the next guy for the “short” on-site. Just a few days, we swear.

Again ... Pinside is not a financial institution... 2fa is more than an inconvenient bridge to far

Increased security sometimes results in a minor inconvenience, unfortunately.

Back in the early BBS days, I'm sure there were folks who thought online accounts with passwords were an inconvenience. Technology marches on.

Like I said... Remove the area which entices these people.

Having the ability to post with a hacked account isn't a security risk.

Having the ability to post an ad in the market place, sure.

I'm not sure what you mean.

Hijacked accounts are absolutely a security issue.

They would have access to the member's entire account, personal details, any contact info saved in PM conversations.

There are three general reasons why scammers do what they do--to trick people into sending them money, to obtain information through social engineering to gain access to something else, or to sell personal information or access to another malicious actor who can use it for other purposes. The last two reasons of course circle back to the first reason.

Increasing security to keep out the bad guys is normally a *good* thing.

Sorry to hear that. But I currently have no intention of getting rid of the feature. Imagine what a hacker could do by simply gaining acces to a PM box of a long established Pinsider. This is not just about placing fake ads.

Constructively, what aspect do you dislike? Are you logging in and out many times a day?

Seat belts are SO uncomfortable and chafe my pinball jelly rolls.

Nope.

MFA is minimum standard for secure online access. Pinside is a world class website and should (nay, MUST) be administered as such.

If it stops or dentures a hacker I’m for it.
Thanks Robin!

Not really akin to seatbelts, more similar to your car refusing to start until your seatbelt buckles, which would really just be annoying.

If we’re using the seatbelt metaphor: We shouldn’t get inconvenienced/punished for some people using a flimsy piece of string instead of a robust belt!

I sure understand the security importance of this, but it might be a bit of a nuisance since my 5G Internet provider does have quite a short time for DHCP lease, and also the external IP changes often (daily).

Maybe would be better to login at morning and stay logged in for the day, instead of only logging in while posting a message.

I don’t think that matters the way it is implemented. As long as your browser keeps your cookies and you don’t log out manually, you should rarely need to log in.

I think this is a good enough approach for a pinball website and will eliminate most account hacks.

You’ve got to be kidding.

Fixed it for clarity. I was trying to give an accurate example of the shitty seatbelt metaphor but realize it was counterintuitive. It’s fixed now.

Either way, Seatbelts also are shown to increase crashes due to careless drives with a false sense of security... hmmm I wonder if that maybe be relevant to this topic!

Whats the point of making it optional? Would defeat the purpose given the only benefit of hacking a Pinside account would be to scam other users.

Sorry, from an implementation perspective it may feel that way, but it's much more critical than that from a security perspective.

People love to bitch about change in life/routine, but this really is a minor one.

Unless you're in a public/shared computer use case requiring a logout AND that computer's public IP is changing regularly, you will rarely hit the additional challenge.

+1 for MFA, but SMS MFA is costly (twilio (referenced above)) for example is ~$0.007 per transaction in the USA, outside USA, looking at $0.02 (canada) etc...

TOTP (google Authenticator) or e-grid (bingo card) would be best/ easiest / cheapest to implement, with no external dependencies.

Thanks for replying Robin.
Actually, I probably over-reacted there.
I do dislike having to recieve and input a code during a login.
I do typically log in and out from different devices and different locations several times during the day.
I had (wrongly) assumed that the code input would be necessary every time, since it would not match the previous login. It looks like the code is only once for each location. That's much less intrusive and distracting.
You are probably right to increase safety, to whatever reasonable degree you can.
It does make Pinside seem a little more like a business login, and not just for fun. But maybe that can't be avoided.

It's because we enjoy the mystery of beating our forehead on the desk and wondering why we have a headache.