I have now done the tedious work and enabled 2FA for all accounts in my gopass (if the site offered an option).

enter image description here

Some only offer insecure SMS or a proprietary app, or even nothing at all.

What is noticeable, however, is that discussion forums do not offer 2FA. Did I miss an option? Some hidden feature? Stack Overflow / Stack Exchange, for example, does not offer such a 2FA option.

Isn't it a very big security risk if someone possibly publishes posts in my name? Or what are the reasons for not offering 2fa on discussion forums? There is a quite small amount of CMS developers for discussion forums.

1 Answer 1


Security controls exist to counter threats. If the risk is low, then one has to weigh the costs and inconvenience of adding a control. The benefit has to outweigh the costs.

For a lot of discussion forums, the risk is minuscule. So, to add a process where you force users to register for 2FA then interrupt their visit to the site with a 2FA challenge, the Cost/Benefit ratio is out-of-balance for the user.

Add to that the development and maintenance costs plus helpdesk support for when things go wrong, then the Cost/Benefit ratio is out-of-balance for the website and developers.

However, sites like StackExchange offer options for visitors, like SSO. SSO providers offer 2FA.

It can, and does, make sense for some discussion sites to offer, or even enforce 2FA. But for a lot of sites, it doesn't. It's a risk calculation.

And as we see the widespread adoption of passkeys, then this issue will just slowly disappear.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .