I appreciate the lesson on security and the response to a threat a user has demonstrably faced on this very platform. The move is not surprising to me. But I see myself having practical issues with this move. I am still going to setup MFA (and perhaps the admin can see that I have already done that), but I would like to summarize my concerns since I see that other folks are echoing some of them. Since this is a porn website, tying my irl identity to this forum is the main thing I personally want to avoid, especially as a user instead of a seller of some good/service.
- Friction: [See [Meta] The super simple 50 step guide to advanced masturbation!; for a summary, this is adding a 51st step in an already long and tedious process.
- Passkeys: I hear you, passkeys do remove the burden of step 1. However, for me personally passkeys are an issue because they leave a fingerprint on my device. The app storing my passkey will note the domain name of the website. I personally am not comfortable with that. With my scenario, I don’t wish to leave any details on my machine that can be traced to this site (to a reasonable degree; I am not going to zero my drive just to remove all data). I know this is not the case for everyone. But for me personally, passkeys are not a (good) solution. I don’t have the concern about facial recognition or whatever; you don’t need to use that for passkeys, you can just use a password to unlock your passkeys if you are so concerned about it. I have thoughts on how this issue of passkeys can be fixed, but a) the wider web is not really going to listen to me, and b) this is hardly the place to argue for it.
- Overkill: Yes, I know I want to be anonymous, but personally, I don’t really care if someone got access to my account or wrote messages in my name because there’s nothing tying my real identity to this account, not even my email id. This is certainly not the case for every user, I understand that.
All this said, like I said earlier, I am still moving to MFA. Token Authentication gets around the naming of domain part since I can just use any name I want. I also understand that this website does require trust between users since it is a sensitive website; don’t want someone to snoop or impersonate.