Multi-Factor Authentication (MFA)
Remove these ads. Join the Worldbuilders Guild
Multi-Factor Authentication (MFA)
Request
As we all here on WorldAnvil know, worlds can be a dangerous place, and our own world is no exception. As WorldAnvil grows it is likely to start attracting people with the intent to cause harm or mischief.
In order to increase the security of our worlds I would like to see some form of MFA implemented in order to add another layer of defence against unwanted account access.
MFA
Multi-Factor Authentication works by using a second device/service as another requirement to log into the account. It is a requirement for the codes to be randomly generated and only useful for a limited amount of time/uses.
Common solutions include, but are not limited to:
- Email: The code is sent to the account email upon attempted login, forcing the person to have access to the email account as well.
- SMS: The code is sent as an SMS, forcing the person to have access to the SIM-card.
- Authenticator: A code generator on your smartphone/electronic device. Forces the person to have access to the device.
All of them have merit, but the SMS version is likely going to have a higher ongoing cost, probably making the other options more likely.
Other uses
MFA could be expanded to be used in other sensitive areas as well, for example world deletion, article deletion (probably wanna turn MFA off when deleting many articles), accessing sensitive account settings (API keys, password change, etc.), changing subscription settings, etc.
Of course it would be best if we had the ability to choose where we want MFA to be necessary. I can see many people turning it off for article deletion.
A neat addition would be if we could say "If there is more than x amount of activity, ask for MFA". An example would be to not request MFA for deleting an article or two, but if suddenly a lot of articles are being deleted, then it comes into play.
The Team's Response
Closed due to low support within the voting period - please feel free to suggest further down the line. As everyone I have a hate / love relationship with 2FA, but I can certainly see its uses. Having said that, 2FA is quite an involved process and it will need a lot more support to be considered.60/300 Votes · +5530 points
Votes Cast
-
+100
by MerlinRafiki
on 2021-05-08 05:06 -
-10
by RizzyStardust
on 2021-05-06 17:34 -
+300
by J.K.H
on 2021-05-06 17:27 -
-300
by A Beloved Dryad
on 2021-05-06 13:29I cannot use SMS or email in my country to gain access to western websites. Please do not do this.
-
+50
by BloodKnightX
on 2021-05-05 17:47When changing password, email address, payment information, or accessing other higher security concerning parts of the account should require mandatory email verification as a minimum. Having other optional forms of MFA and having MFA for other features such as deleting worlds/articles, logging into the account, changing sharing/view permissions would be nice.
-
-300
by Zulltar
on 2021-05-05 04:18No no no no no please no! If you must, at the very least make it optional. If I get locked out of my own account because of excessive security measures one more time I'm going to kill myself.
-
+300
by SunSpear Games
on 2021-05-05 00:32 -
+300
by A Fluffy Cthulhu
on 2021-05-04 18:54 -
+20
by hkuhfeldt
on 2021-05-02 16:47 -
+50
by collindietrich
on 2021-05-01 02:10 -
+100
by Toblin
on 2021-04-30 12:24As any security nutter, I'd really appreciate an opportunity to use an authenticator app for this.
-
+300
by momococa
on 2021-04-29 19:07 -
+300
by Darth_Nikolas
on 2021-04-28 07:16 -
+100
by Anyways655
on 2021-04-28 05:44 -
+20
by kalvorp
on 2021-04-27 23:31I hate two-factor authentication. As someone with a slew of memory and functioning problems, it's incredibly frustrating not being able to access a site or an email or my medical documents because I forgot/broke/lost my phone, or I can't get into my other account, or I just needed to get in for 10 seconds but now I have to leave and the verification hasn't even arrived yet. All of that said, the security benefits trump my personal downfalls lol.
-
+20
by Kaleidechse
on 2021-04-27 15:36 -
+10
by RiverFang
on 2021-04-26 18:05 -
+100
by BCGR_Wurth
on 2021-04-26 16:36 -
+20
by Neverdusk
on 2021-04-26 03:06 -
+50
by Bassalissk
on 2021-04-25 22:33 -
+20
by StardustScrapper
on 2021-04-25 20:37 -
+10
by GlJonny
on 2021-04-25 18:52 -
+300
by Sloqush
on 2021-04-25 11:23 -
+100
by dbgoodin
on 2021-04-25 00:29MFA is great when properly used. If World Anvil does use it consider an app, like Google Authenticator instead of SMS.
-
+300
-
+300
by corasnowbooks
on 2021-04-24 21:15 -
+100
by FableWolfe
on 2021-04-24 20:11 -
+10
by nascarlaser1
on 2021-04-24 16:05 -
+300
by Rahjar
on 2021-04-24 14:58 -
+50
by Rabidcandyvoid
on 2021-04-24 12:44 -
+20
by A Thundering Cthulhu
on 2021-04-24 07:36 -
+100
by AntimatterNuke
on 2021-04-24 04:41 -
+20
by A Filthy Mlem
on 2021-04-24 03:24 -
+100
by ano19920
on 2021-04-23 19:51 -
+10
by SilverLance
on 2021-04-23 19:34 -
+50
by Sajochi
on 2021-04-23 15:53 -
+300
by ka_jan
on 2021-04-23 06:19 -
+50
by scubtle
on 2021-04-23 01:54 -
+300
by Re_Shinobi
on 2021-04-23 00:44 -
+10
by Michael Chandra
on 2021-04-23 00:18 -
+300
by GrinWithoutaCat
on 2021-04-23 00:13 -
+10
by Jaskovivich
on 2021-04-22 19:44 -
+20
by Kummer Wolfe
on 2021-04-22 18:49 -
+20
by Mayren
on 2021-04-22 16:54 -
+10
by Ebb
on 2021-04-22 15:30 -
+10
by FictionFan1995
on 2021-04-22 15:08 -
+100
by MachFarcon
on 2021-04-22 15:03 -
+100
by SunlanceXIII
on 2021-04-22 07:41 -
+20
by brass_phoenix
on 2021-04-22 06:59 -
+100
by A Uncontrollable Dragon
on 2021-04-22 04:14 -
+300
by Autumnstar00
on 2021-04-22 03:08 -
+20
by Master_Zephyr
on 2021-04-22 02:15 -
+100
by Ghostlight.DMs
on 2021-04-22 01:06 -
+10
by Lyraine Alei
on 2021-04-22 01:00 -
+50
by Vulthuryol
on 2021-04-22 00:14 -
-10
by teoiny
on 2021-04-21 22:21 -
+50
by makonnen
on 2021-04-21 18:07 -
+20
by Satrium
on 2021-04-21 18:02 -
+10
by SoulLink
on 2021-04-21 17:50 -
+10
by iamthetot
on 2021-04-21 17:43I am a big proponent of 2FA for all things. If you're reading this and do not currently have 2FA for your other accounts, go do it now.
-
+300
by Snake__Venom
on 2021-04-21 17:37
Find your way!
Resources
WHO WE ARE
LEGAL
Get the news
Listen to our Podcast
Our Allies
