Add a 2 factor authentication

[Whydidthechickencrosstheroad]

This is really required and this is useful in many websites because some people liked to get their account protected and without it, you can get hacked, even with a strongest password possible. Adding this would be useful. If this would exist on Monkeytype, the options are image selector you have to pick an image, then there are more options you can do like riddles you created and so on.

[fehmer]

You can add a 2FA on your github or google account and use them to login into monkeytype.

• Go to settings, danger zone and add google authentication or add github authenitcation
• Logout and sign in with google or github

Currently you cannot remove password based authentication but you could set a very, very long password like 256 characters.

We evaluated to add 2FA directly to monkeytype but this would be to expensive.

[Miodec]

@fehmer adding a second sign in method wouldnt be considered a multi factor auth and in theory it could lower the security if both passwords and gmail passwords are weak

To clarify on 2FA:

I would love to add 2FA. However, Firebase (which we use for authentication) for some reason doesnt support it out of the box. I would need to pay for some "enhanced identity toolkit" or whatever, which with the current amount of users would cost actual thousands of dollars per month. I really dont know why its this expensive.

The other option would be creating an auth system from the ground up, which is frankly scary, and not feasible at the moment.

[fehmer]

My point was to use login with github/google account which requires 2FA and remove password base login from monkeytype (#5499 ). This way you would need 2FA to access monkeytype.

[Whydidthechickencrosstheroad]

It has been 2 weeks and we still need this (or has not been added yet). Please add it

[fehmer]

It is now possible to remove password based authentication if you have google/github authentication.

• configure your Google/Github account to require 2FA
• add Google/Github authentication to your account
• remove password based configuration

[Whydidthechickencrosstheroad]

Actually, it might work but it might not protect the account always (the thing you just said @fehmer)