Implement 2-factor authentication (2FA/2SV/MFA) Thread poster: ezpz
|
|---|
ezpz 
Local time: 02:05
Member (2009)
English to Spanish
+ ...
Today we had trouble logging into the site because of a bug with Google Captcha:
- https://www.proz.com/forum/prozcom_bugs/369937-i_cant_log_in_staff_working_on_a_fix.html
After complaints, site staff/developers temporarily disabled Captcha.
I fear the site is now, temporarily, exposed to brute-force password discover... See more Today we had trouble logging into the site because of a bug with Google Captcha:
- https://www.proz.com/forum/prozcom_bugs/369937-i_cant_log_in_staff_working_on_a_fix.html
After complaints, site staff/developers temporarily disabled Captcha.
I fear the site is now, temporarily, exposed to brute-force password discovery while this bot-detection measure is disabled.
I think that this risk would be somewhat mitigated by implementing (optional) 2-factor authentication (also called multi-factor auth and two-step verification).
Essentially: after entering your username and password, you are then asked for a one-time pincode for extra security.
Typically, you would set up a OTP-generator by using an app on your phone - scan a QR-code on screen, then verify that the generated 6-digit pincode is correct. There are similar programs available for computers too, where the setup involves simply typing in the secret "seed" (instead of scanning a qr-code).
[There are other possible "factors" too (hardware usb-keys for example), which could be more convenient/secure for some users; but I only want to warn against codes delivered via SMS messages because this is quite insecure.]
An additional benefit of adding 2FA is that ProZ.com could probably save on Captcha costs, by only triggering human verification after cumulative wrong password events:
- 3 stages/webpages loaded during login: Enter user -> Enter pass -> Enter pin
- At stage 1, if user has accumulated more than 1-2 wrong pass events, trigger Captcha before allowing onto stage 2 password-entry.
The site developers are surely better informed about implementation than I will ever be.
I just wanted to post this suggestion to encourage other users like myself to request this as a priority in the currently on-going "site re-design".
Thank you for your consideration ▲ Collapse
| | | | | Why, for crying out loud? | Oct 12, 2024 |
Firstly, who needs to brute-force ProZ? What do hackers stand to gain by breaking into a ProZ account? Not much.
Secondly, even if I am wrong and someone wants it, inventing a password that's easy to remember but virtually impossible to brute-force is a trivial exercise, and tutorials on that are all over the web.
Thirdly, 2FA is actually a measure against password theft - protection against brute force is merely a byproduct.
In this situation, the inconvenience of 2FA will out... See more Firstly, who needs to brute-force ProZ? What do hackers stand to gain by breaking into a ProZ account? Not much.
Secondly, even if I am wrong and someone wants it, inventing a password that's easy to remember but virtually impossible to brute-force is a trivial exercise, and tutorials on that are all over the web.
Thirdly, 2FA is actually a measure against password theft - protection against brute force is merely a byproduct.
In this situation, the inconvenience of 2FA will outweigh its benefits. ▲ Collapse
| | | | ezpz
Local time: 02:05
Member (2009)
English to Spanish
+ ...
TOPIC STARTER | Optional, added security | Oct 14, 2024 |
[0.] I did a search on this forum before posting. There are no posts requesting 2FA. In my opinion, "for crying out loud" should be reserved for repeated, unwelcome insistence.
1. Other than access to paywalled features, if you are using features such as Invoicing you may want to keep that information private. The question really is not "why" but "how".
2. A strong password is a first-layer deterrent. You should be doing that anyway.
3. 2FA adds a second-la... See more [0.] I did a search on this forum before posting. There are no posts requesting 2FA. In my opinion, "for crying out loud" should be reserved for repeated, unwelcome insistence.
1. Other than access to paywalled features, if you are using features such as Invoicing you may want to keep that information private. The question really is not "why" but "how".
2. A strong password is a first-layer deterrent. You should be doing that anyway.
3. 2FA adds a second-layer. The rationale being that if your password is discovered, the hacker still needs your "second password", which directly increases the difficulty of brute-force to gain access.
[4.] For people who logout and clear session cookies, a bigger inconvenience is having to perform between 1-6 ReCaptcha tests to prove they are human. Typing in a 6-digit code, or copy-pasting it, is arguably more convenient.
[5.] As I said, 2FA should be an optional new feature. I do not want you to be obligated to change the way you are currently used to logging in if you do not want to. ▲ Collapse
| | | | | I think Proz staff will find the best solution | Oct 14, 2024 |
I'm sure the Proz team will find the best solution to protect themselves and their users when they update the site for good.
I think the reason for so many bugs (not only this one) has to do with the testing they do for the new image of the site... I don't know, I'm not sure.
I don't use to delete everything on my computer at once, such as cookies and the like, but this time I got distracted.
As for the Captcha images, I haven't seen them for a long time, probably since I upda... See more I'm sure the Proz team will find the best solution to protect themselves and their users when they update the site for good.
I think the reason for so many bugs (not only this one) has to do with the testing they do for the new image of the site... I don't know, I'm not sure.
I don't use to delete everything on my computer at once, such as cookies and the like, but this time I got distracted.
As for the Captcha images, I haven't seen them for a long time, probably since I updated my antivirus software.
However, this time they kept popping up, to the point of irritating me and not having access to the site in any way.
And no, I didn't get my password and username wrong.
My invoicing is done via the Portuguese Tax System. It's the only and legal way for me to do it. So, I that wouldn't be a problem for me.
I would like to thank the staff again for giving me and the others access to the site.
Otherwise, I wouldn't be able to use it and since I'm paying my annual membership fee and I'm no less than anyone else, I think it was a reasonable and fair decision.
If they have done it that way temporarily, I believe they took their precautions to not get hacked or 'exposed to brute-force password discovery'. ▲ Collapse
| | |
|
|
|
ezpz
Local time: 02:05
Member (2009)
English to Spanish
+ ...
TOPIC STARTER | 2FA via email code is now available | Feb 22 |
I am not sure when this was implemented by ProZ, but currently two-factor authentication is available through a 6-digit code that is sent to your email every time you log in.
This setting can be toggled here:
https://www.proz.com/settings#user_2fa
It is entirely optional.
This is not as secure, in my opinion, as a typical Authenticator app where you have... See more I am not sure when this was implemented by ProZ, but currently two-factor authentication is available through a 6-digit code that is sent to your email every time you log in.
This setting can be toggled here:
https://www.proz.com/settings#user_2fa
It is entirely optional.
This is not as secure, in my opinion, as a typical Authenticator app where you have to scan a QR code / seed for setting up an offline code generator, but this is a second factor, and it is a good start. ▲ Collapse
| | | | Zea_Mays
Italy
Local time: 03:05
English to German
+ ...
MFA is standard practice and implemented by many sites. It's also what I suggested ProZ against scammers, as I think it would help contain that serious issue a bit. But in order to work, it must be mandatory.
Most of the websites where I log in send a code via SMS (I don't think this method is that insecure as stated), and in order to not being annoyed with the process on every single site visit, I choose the option to stay logged in.
I oppose authenticator apps though, as I ... See more MFA is standard practice and implemented by many sites. It's also what I suggested ProZ against scammers, as I think it would help contain that serious issue a bit. But in order to work, it must be mandatory.
Most of the websites where I log in send a code via SMS (I don't think this method is that insecure as stated), and in order to not being annoyed with the process on every single site visit, I choose the option to stay logged in.
I oppose authenticator apps though, as I bet they collect data, and the less apps you have to download on your devices the better.
[Bearbeitet am 2026-02-22 13:07 GMT] ▲ Collapse
| | | | Novian Cahyadi (X)
Local time: 09:05
| ezpz
Local time: 02:05
Member (2009)
English to Spanish
+ ...
TOPIC STARTER | Must manually log out of previous sessions, link below | Feb 23 |
After enabling 2FA, unlike other websites, ProZ does not log you out of current sessions elsewhere.
I was surprised to see I am still logged in on my laptop, despite having logged in before turning on two-factor authentication.
You must log out manually by going to this page:
https://www.proz.com/?sp=session_info&popup=y
I suggest doing this perio... See more After enabling 2FA, unlike other websites, ProZ does not log you out of current sessions elsewhere.
I was surprised to see I am still logged in on my laptop, despite having logged in before turning on two-factor authentication.
You must log out manually by going to this page:
https://www.proz.com/?sp=session_info&popup=y
I suggest doing this periodically even if using a single computer and browser, as cookie theft is unfortunately common nowadays. ▲ Collapse
| | |
|
|
|
Zea_Mays
Italy
Local time: 03:05
English to German
+ ...
| pondering is the key | Feb 23 |
Nothing new, but the described scam methods are very unlikely to happen en masse (also given the rather rare use of SMS these days vs apps like WhatsApp) and require the users themselfes to act.
It's just a matter of risk weighing vs user experience for security staff: If the measure has rather little risks attached, it is to prefer over additional actions the users need to take in order to get access to the site. The less fuss the more user friendliness.
| | | | Novian Cahyadi (X)
Local time: 09:05
Zea_Mays wrote:
If the measure has rather little risks attached, it is to prefer over additional actions the users need to take in order to get access to the site. The less fuss the more user friendliness.
MFA is supposed to be optional. Even on security and privacy-focused services (e.g., Proton, Tuta, and Bitwarden), MFA is disabled by default. Users who wished to better secure their account can enable MFA. I'm sure they wouldn't mind the extra "fuss" you were talking about. And I know that because I'm one of them.
Those that don't wish to take an additional step can simply use a password. Those that care even less can just use passWord123. In the end, we're all responsible for our own actions.
| | | | Zea_Mays
Italy
Local time: 03:05
English to German
+ ...
Novian Cahyadi wrote:
Zea_Mays wrote:
If the measure has rather little risks attached, it is to prefer over additional actions the users need to take in order to get access to the site. The less fuss the more user friendliness.
MFA is supposed to be optional. Even on security and privacy-focused services (e.g., Proton, Tuta, and Bitwarden), MFA is disabled by default. Users who wished to better secure their account can enable MFA. I'm sure they wouldn't mind the extra "fuss" you were talking about. And I know that because I'm one of them.
Those that don't wish to take an additional step can simply use a password. Those that care even less can just use passWord123. In the end, we're all responsible for our own actions.
In this case the point is that the measure would help limit scammers on the platform.
All major websites use MFA, which is highly recommended by security experts, and give you options to choose from that start from something simple as sms.
But there are some prominent actors that seem to think they can do without or not even verify email addresses, like PayPal(!).
I know this because someone opened a PayPal account with one of my main email addresses (her name is the same as mine), and obviously I was notified on this, but was not asked to confirm it was actually me!
The same person still uses that address to register on various websites that do not verify addresses (like required per GDPR in the EU) and then send me receipts, newsletters etc.
That's another story of course, but it is a sign that security is not taken seriously by many in an online environment where bots are steadily searching for weak spots to abuse for cyber crime.
| | | |
Hi everyone,
Thanks to all who contributed to this discussion, and to EZPZ for bringing the point forward in the first place.
As he notes, two-factor authentication (2FA) is now available on ProZ.com as an optional feature. Users can enable a 6-digit verification code sent to their registered email address at login via th... See more Hi everyone,
Thanks to all who contributed to this discussion, and to EZPZ for bringing the point forward in the first place.
As he notes, two-factor authentication (2FA) is now available on ProZ.com as an optional feature. Users can enable a 6-digit verification code sent to their registered email address at login via their settings page:
https://www.proz.com/settings
This is a first step. We recognize that email-based verification is not the only 2FA method users may prefer. Additional authentication options (including app-based authenticators) are planned as part of the new site architecture currently in development.
Regarding the concern about brute-force attacks: CAPTCHA is one visible layer of protection, but it is not the only safeguard in place. ProZ.com also uses behind-the-scenes protections, including security and traffic monitoring systems such as Cloudflare, which help detect and mitigate automated attacks and suspicious login activity.
Security improvements are being approached in layers. In addition to expanded MFA options, updates to the registration and verification process are also in progress and will be rolled out within the new platform releases. These updates are intended to strengthen account integrity while balancing usability.
If you have specific concerns about your account’s security or privacy, please submit a support request at:
https://www.proz.com/help
We appreciate the feedback shared here. Security is an ongoing process, and community input plays an important role in helping us prioritize enhancements.
Thank you for taking the time to raise and discuss this! ▲ Collapse
| | |
|
|
|
| Update: two-step login now covers every login, plus login alerts | Oct 20 |
An update on the "first step" mentioned above: two-step login now covers every way of logging in (password, Google, Facebook, LinkedIn). Turning it on signs out your other sessions, and you can choose to remember a trusted browser for 30 days. We also now email you when your account is signed in from a new browser or device, and when your password ... See more An update on the "first step" mentioned above: two-step login now covers every way of logging in (password, Google, Facebook, LinkedIn). Turning it on signs out your other sessions, and you can choose to remember a trusted browser for 30 days. We also now email you when your account is signed in from a new browser or device, and when your password or login email changes. Settings: https://www.proz.com/settings/freelancer/account#two-step
ProZ.com Support Team ▲ Collapse
| | | | To report site rules violations or get help, contact a site moderator: You can also contact site staff by submitting a support request » Implement 2-factor authentication (2FA/2SV/MFA) | LinguaCore | AI Translation at Your Fingertips
The underlying LLM technology of LinguaCore offers AI translations of unprecedented quality. Quick and simple. Add a human linguistic review at the end for expert-level quality at a fraction of the cost and time.
More info » |
| | Pastey | Your smart companion app
Pastey is an innovative desktop application that bridges the gap between human expertise and artificial intelligence. With intuitive keyboard shortcuts, Pastey transforms your source text into AI-powered draft translations.
Find out more » |
|
| | | | X Sign in to your ProZ.com account... | | | | | |
Login to reply/comment 
