I have a friendly, fun bot on Twitch. I haven't logged into its account for ages, purely communicating with the Twitch API and their IRC service.

The other day, they announced a new annouying "Oauth" requirement to access their API. As a result of this, I was forced to log in to the account. Of course, I had noted down the username and password, but after providing them, it didn't let me log in. Instead, it said that it has sent some kind of one-time code to the e-mail address associated with the account, which I've long since lost access to and which was a throwaway one to begin with.

As a result, I'm forever locked out from the account. I can never log in to it ever again, even though I have the password. I can't stress this enough:

I have the password, but cannot log in to the account.

Why do they do this? The Internet has become a broken mess where no site, no form, ever lets me actually use it anymore without harassing me. I'm made to sit and click on images for half an hour and then they still show an error in the end. Weird codes are sent to long-abandoned throwaway e-mail addresses. Fake error messages all the time.

How could I have "guessed" the password on the first try?

I've stopped even trying to register accounts or do anything because it never works anymore.

  • 1
    "How could I have 'guessed' the password on the first try?" -- Head down to haveibeenpwned.com. You might have excellent password hygiene, but then you'd be a true rarity, and sites know that the vast majority of its users will reuse their passwords on other sites, making it extremely easy for an informed attacker to guess right on the first try.
    – Ghedipunk
    May 7, 2020 at 0:38

2 Answers 2


Single factor authentication is a method whereby you are required a piece of secret information to be able to authenticate. Typically a username and a password. The main problem with this is that passwords are often short, reused across multiple services, based on dictionary words, etc. Consequently attackers are able to not only find passwords on previously breached services and attempt to reuse them against other services, but also make highly effective guessing attacks.

Multi-factor authentication is a method whereby you are required a piece of information that you know and at least one more that you have. For example a username, a password and a one-time token from an authenticator app. This makes it far more difficult to compromise a given account, since guessing or finding or stealing the correct password will no longer be sufficient to gain access to the account. This is a very beneficial security feature.

Since you lost access to the email address you used to register your account all you can do now is ask support very nicely if they can help you in any way. A round 'no' isn't entirely unexpected though since what you did may even go against their T&Cs.

  • That explains why you'd want new accounts with MFA, but not why you'd lock out old accounts that didn't upgrade. I've lost a couple Gmail accounts this way last year, suddenly Google decided since I didn't list any phone, I can't access my mail. Availability is one of the three pillars of security, if I lose all access without any hostile action, simply because provider said so, the provider is the malicious actor.
    – Alice
    May 13, 2020 at 7:41

In recent years, social media sites have put these measures in place. They may be used to either prove that it is a human accessing the site or place friction on machine attempting to access the site. They also may be trying to limit fake (or extra) accounts, and get close to a one-to-one ratio of humans to accounts.

Without email or phone verification (even if the user has not enabled two factor authentication), the sites assume the account is not real. This is obviously not a full proof system by itself, but it is one tool that is used to create friction.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .