In light of recent discussion. I am deciding it’s best for everyone to have multi-factor authentication enforced for the forum. This enhances your security to prevent advanced phishing techniques as well as prevent chain compromised attacks and credential stuffing.
You can enable MFA here : Account > Preferences > Security
I also highly advise using Passkeys, this is effectively a guarantee to prevent unauthorised access even when your computer is compromised (depending on implementation)
MFA enforcement is coming 2026-03-31T00:00:00Z
I recorded a video to help you out: (unfortunately streaming isn’t working)
https://od.lk/d/NzFfMzAzMTEwNjVf
I will be doing an educational Livestream on discord 2026-03-01T20:00:00Z
There’s a lot of misinformation surrounding MFA being spread, so I’m writing this additional portion to inform you.
Q: What exactly is being enforced?
A: TOTP authentication is being enforced. Nothing else. Everything else is optional.
Q: Is this private? What sensitive information will be given to you?
A: No sensitive information will be visible, nor stored by me. In the case of TOTP I will only have stored a symmetric key which is used to generate OTP codes. This key cannot be used to identify you.
Q: What apps can I use that are privacy respecting for being an authenticator.
A: Technically all of them are. But if you’re paranoid (and you should be) using an offline authenticator that is FOSS (Free And OpenSource) is best.
Q: How does this enforced MFA work?
A: When you enroll a TOTP, what happens is a symmetric key is generated (Symmetric means the key is the same, not public/private). You keep yours in your authenticator and the authenticator app generates one-time passwords (OTPs). These codes change every 30 seconds which is why it’s Timed (Timed one-time passwords (TOTP)). When you authenticate, you enter the current code and if it matches the code the server is expecting (they’re doing the same thing on the server), then you authenticate.
When you enroll your authenticator, you can scan a QR code or manually enter the key. For additional privacy, manually entering the key is preferred.
The QR code will provide more than just the key, it also contains metadata that you don’t necessarily need. Review the video above I have recorded, it covers how you can remove this metadata for additional privacy.
Q: How is this different from discord’s id verification?
A: I don’t want your private information, and I don’t need it for you to prove you own an account. MFA is a way to prove you are who you claim to be. This claim can be completely anonymous, and not contain any information about you. I can claim to be VladTheImplier, but I need to prove I registered that account and own that account. VladTheImplier is not my real name.
Q: What is a Passkey?
A: This is a complex topic so I have 2 answers:
Short answer: This is a password replacement that’s very convenient to use and skips traditional MFA. The original domain to a passkey is tied to the login process, making it impossible to fall for a phishing page when using passkeys.
Long Answer (contains in-depth technical information)
Using passkeys requires a passkey store (This can be a U2F usb key, password manager, your phone, your OS, etc.)
Passkeys enforce MFA + intentionality + Cryptographic authentication. I’ll explain each of these.
MFA or Multi-factor authentication is an authentication scheme that requires 2 or more of the three factors:
- Something you know (password/pin/OTP/TOTP)
- Something you have (Private key/Connection location/Device/USB Key)
- Something you are (Biometrics/FaceID/Fingerprint/etc)
These factors are components of proof that you are who you claim to be. They do not require separation like many people believe. You can combine multiple factors in 1 action to account for more than 1 factor the example below will explain this.
Intentionality is proof that you intend to authenticate. You have to interact somehow to show you are intentionally logging in. This is often done via, tapping your USB key’s capacitive contact, presenting your biometric, or pressing a button.
The cryptographic component is where basically all the security is. What is being done is a signing challenge. (Some additional details are being glossed over, but this is the main process)
- User initiates a login by requesting an authentication
- The server generates a challenge, a random string of bits, called a nonce, and sends that to the user
- The passkey store when unlocked digitally signs the nonce, this creates a signature. (encrypted nonce)
- The encrypted nonce is sent back to the server, where the server decrypts the nonce with the public key of the cooresponding passkey
- When the decrypted nonce matches the original nonce after decryption, this proves only you could have signed the nonce.
There is an important note to add that the origin domain to a passkey is cryptographically bound to the nonce signing process. This means it is cryptographically impossible to fall for a phishing page when using passkeys
So finally what does a Passkey authentication look like? I show this in the video but this is a text description.
- You click “sign in with passkey”
- You’re asked to interact to use the passkey (picking the passkey in a list, presenting biometric, clicking a button, etc.
- The passkey performs the signing challenge and you are logged in.
The detailed version goes like this (Assuming you only have a simple passkey in a password manager):
- You click “sign in with passkey”
- You’re asked to interact (Intentionality).
- You use either a pin, or password to unlock your password manager (1 factor).
- This unlocks your passkey for the signing challenge. (second factor being the private key you can’t see)
- This is a 2 factor authentication. (Yes if your password manager is already unlocked, that still counts as having an unlocked vault, So pre-unlocking your password manager is still 1 factor)
