So, my two cents, from some actual professional experience. So far a lot of suggestions have a lot of throwing out the baby with the bathwater side-effects.
Concerning 2FA:
I work as a Data Loss Prevention IT expert for a large corporation. 2FA, and a lot of other security measures, have a visible impact not just on security, but also on behavior. For one, everything does get a lot more secure. The side effect? If people don't absolutely need it, some will stop using it. 2FA is a barrier to entry. A nuisance. Especially if they move around a lot (and the session expires) they will have to repeatedly reconnect.
Secondly, telephone numbers are considered PII (Personally Identifiable Information). That means that when storing this information, no matter how much you encrypt it, the site now needs to comply to the GDPR (General Data Protection Regulation), which are part of Europe's privacy laws. I actually work professionally a lot with our legal department on this one. For this particular site, it would mean that it has to be compliant by making a Privacy Impact Assessment, record how the PII is processed, and make possible the Right of Access, Right to be Forgotten and Right to be Informed.
And no, the site being hosted outside of the EU does not make it exempt. Charges can be filed from within the EU if the site is not compliant while processing EU citizen PII.
That said, 2FA can be made possible, it's just going to be a lot of work. Question is, why would we be doing it? So we can try to block a very small group of disruptive users? Baby, bathwater.
Forum badges, post count, etc.
A long, long time ago, in a forum far away, I moderated a huge Blizzard fansite. *huge*. Thousands of new users signing up every day. Naturally, there were trolls. armies of them in fact. And it being the 90's, we fell into all the 90's pitfalls of what was 'cool' at the time. Like the aforementioned forum post count and badges. Oh boy...
The problem with prestige; people want it. People *crave* it. If there is any way of showing off that one person is *better* then someone else, hoooo boy they will go grind that badge, or post so much crap that they will have ten thousand, no, a HUNNERD THOUSAND posts! Wooooooo!
Basically, the post count being shown is enough for a lot of people to start posting crap. Now I don't know about you guys, but in this environment I would rather see quality posts, rather then people making one-liners.
Last edited January 18, 2021 9:55 am