Looking at the recent forum posts about account breaches and stuff, I wondered why LFS doesn't have a two-factor authentication system? I think it could be a good addition as an optional choice for additional account security, via phone number or similar. I don't know how feasible this is technially, but is an interesting discussion point, what do other users think?
2FA as additional account security?
(19 posts, started , go to first unread)
2FA as additional account security?
(ALEXBGK)
DELETED
by Scawen : not needed
I dont think you need 2FA for a game, just be hygienic about internet exposure/security :
- Use password manager[pwm] (you only memorize one big password that you only use in one place to unlock the pwm. all generated passwords are random (attached image as example)
- Check the browser address bar and/or check the hyperlink text on the bottom of the browser before clicking hypertext or when visiting a website
- When using an app and someone sends you a link instead of clicking and opening the link, copy the link, paste it on the browser, verify website is what you expect or recognize
- If it's too good to be true, then don't.
I could bet my money that the 10% of LICENSED valid accounts "stolen", are "new" accounts, i.e iPad kids
- Use password manager[pwm] (you only memorize one big password that you only use in one place to unlock the pwm. all generated passwords are random (attached image as example)
- Check the browser address bar and/or check the hyperlink text on the bottom of the browser before clicking hypertext or when visiting a website
- When using an app and someone sends you a link instead of clicking and opening the link, copy the link, paste it on the browser, verify website is what you expect or recognize
- If it's too good to be true, then don't.
I could bet my money that the 10% of LICENSED valid accounts "stolen", are "new" accounts, i.e iPad kids
The way LFS auth is setup though, there's really no great reason as to not have 2fa (even if it's email codes, but TOTP better) because you already have separation between securing your game account vs accessing the game.
Pretty much every online platform, including gmaes like iRacing and Steam offer some 2FA option or even OAuth (to allow another platform's TOTP/Passkey to secure the account)
From the latest post by Scawen it looks like only breach were people entering their LFS username and password in other websites or apps. Sounds harsh,but that's pretty much their own stupidity. 
2FA shouldn't be a priority, sure better security is better, later update is worse.
The current system is working for 99(.9?)% of users.
iRenting and Steam are not games, more like bank accounts where users dump hundreds (more like thousands) of FIAT money.
FYI: Fiat money is a type of government-issued currency, authorized by government regulation to be legal tender. Typically, fiat currency is not backed by a precious metal, such as gold or silver. Since the end of the Bretton Woods system in 1976 all the major currencies in the world are fiat money.
source
edit- additional non-requested or relevant (for the thread) information
FYI: Fiat money is a type of government-issued currency, authorized by government regulation to be legal tender. Typically, fiat currency is not backed by a precious metal, such as gold or silver. Since the end of the Bretton Woods system in 1976 all the major currencies in the world are fiat money.
source
The current system is working for 99(.9?)% of users.
iRenting and Steam are not games, more like bank accounts where users dump hundreds (more like thousands) of FIAT money.
FYI: Fiat money is a type of government-issued currency, authorized by government regulation to be legal tender. Typically, fiat currency is not backed by a precious metal, such as gold or silver. Since the end of the Bretton Woods system in 1976 all the major currencies in the world are fiat money.
source
edit- additional non-requested or relevant (for the thread) information
FYI: Fiat money is a type of government-issued currency, authorized by government regulation to be legal tender. Typically, fiat currency is not backed by a precious metal, such as gold or silver. Since the end of the Bretton Woods system in 1976 all the major currencies in the world are fiat money.
source
And was your LFS account free?
I'm not saying that 2FA absolutely needs to be implemented right now,I don't want to slow the actual game update progress at all. I just wanted to see what thoughts of other people are on the topic. I agree with gu3st that more seperation between the game and the accoutn is better, but also cuni has a good point as in not to prioritise this.
It doesn't matter if it's iRental or steam or LFS or any other random paid or free platform, it should have some way of 2FA IMO. Passkeys would be great as well.
Make it optional, but implement it.
Those that care to use it will use it, everyone else can sit on their bum.
Those that care to use it will use it, everyone else can sit on their bum.
I bet Porsche money would work better.
Optional 2FA would be nice, but also Scawen working on the main update would be even nicer, this incident doesn't look that huge.
About "just being stupid" - we are all stupid, one way or another. So anything protecting users better without adding too much friction would be nice. Nice to have. But also eating into development time.
Free = 35 eur / 1 500 eur = 2.33% ?
PS-I edited my previous post for your confort
ok guys i went on another tangent, so i went digging and searched "LFS wiki prices" to know how the price applied in average around europe and found this -
Didnt found what I wanted but found its pretty much free
Didnt found what I wanted but found its pretty much free
<?php
[code] i will end the offtopic here sorry[/code]
?>It makes no sense why you're defending so strongly against security lmao.
Do you have a vested interest in making it easier for accounts to be stolen?
Do you have a vested interest in making it easier for accounts to be stolen?
With an existing requirement for separate web and game passwords, a 2FA protection purely on the web account would be a good stop-gap solution.
Exactly, why is more security so bad? Even if we follow all of cuni's instructions in his first post in this thread, your account can still be compromised, more is always better.
As someone who works in cybersecurity, I like this.
Sure , A FIDO2 system would be better, but the new current system straddles the need between 2FA and supporting legacy code.
Sure , A FIDO2 system would be better, but the new current system straddles the need between 2FA and supporting legacy code.
SMS (Phone) verification costs money but authentication apps (Google Authenticator etc.) could be added. E-mail would be counterintuitive as we already need an e-mail to unlock our game.
No matter how secure I am, I think it would be much safer to have 2FA enabled.
I've been a victim of account theft, and the only accounts that haven't been stolen are LiveForSpeed and Facebook (because Facebook itself blocked them).
The account I use happened to be on the email address that was stolen, and I was able to recover it. But if I had 2FA enabled on LiveForSpeed, like I have on my other game accounts, for example, I'd be at peace, even though the security is currently very good.
But if we lose access to our email, we could lose access to everything 💔
That's why I think that in the future, LiveForSpeed could have the opportunity to have 2FA and perhaps a mobile app to accept or decline account entries (like we have on Steam, for example).
I think all security is always the best possible, and it never hurts to have good security. 💪👏🙏
I've been a victim of account theft, and the only accounts that haven't been stolen are LiveForSpeed and Facebook (because Facebook itself blocked them).
The account I use happened to be on the email address that was stolen, and I was able to recover it. But if I had 2FA enabled on LiveForSpeed, like I have on my other game accounts, for example, I'd be at peace, even though the security is currently very good.
But if we lose access to our email, we could lose access to everything 💔
That's why I think that in the future, LiveForSpeed could have the opportunity to have 2FA and perhaps a mobile app to accept or decline account entries (like we have on Steam, for example).
I think all security is always the best possible, and it never hurts to have good security. 💪👏🙏
Exactly, but even email isn't 100% secure.
At the beginning of the year, I was lucky my LiveForSpeed account wasn't stolen because they hacked my email account and stole almost all my social media and Discord accounts.
I was only lucky because I managed to contact Discord, X, and Steam and Facebook, where I was able to block access.
But I completely lost my Instagram account because they managed to get in and change everything, and now it's a lost account.
If LiveForSpeed had 2FA in an app similar to the one we have on Steam on mobile, that would be very positive and an added benefit.
2FA as additional account security?
(19 posts, started )
FGED GREDG RDFGDR GSFDG