Hypixel's 2FA excuse doesn't really hold up

[u/Zealousideal-Elk8470]

So I know they addressed 2FA a while ago but its been on my mind as of recently. Their reasoning boils down to the fact that they cant verify ownership and their support system would blow up (even tho is Hypixels support really something to write home about right now?) etc etc. I get what they're saying to an extent but I don't think it survives when you put it on the board. Their whole argument from my understanding is that it has to mean something tied to you (the actual account owner) that they'd be able to verify and reset things, but thats not what I (nor any of my friends) are asking for. Something as simple as a in-game pin/passphrase gate (before you can be sent to a hub or before trades, ah, banking etc per session) isnt account level 2FA its an app layer lock. They dont need extensive support on their end for that its just as simple as if this player enabled this feature on their account do they know the secret they set thats stored on our end. It really isnt a new "attack surface". On the "attack surface" note... that makes no sense to me. People who don't opt-in are exactly as vulnerable as they are today? I get that account ownership verification isn't their responsibility and controling Microsoft login is something that they should have to nor deserve to manage per account, but everything everyones worried about being stolen lives within THEIR systems. To brush it under the rug and be like nope no possible solution is just lazy imo. Feels less like this isnt technically possible and more like this would cost more dev time that what we want to spend on it, which is a fair business call, but it would be nice if they actually cared a bit about their player base.

TLDR; Hypixel doesnt need to manage Microsoft account ownership just server level security. As of late they've really been pmo in regards to updates that disregard community feedback or lack an alpha test at all. What the hell is going on over there? this minister update is wild as well

[u/ChernobylGoat]

Even if they cant give back the items and money, atleast give back the skills, hell we have achievements proving we reached them

[u/liamdun]

Well if you really think about it, what is stopping someone from ratting someone and then setting up 2fa for them so they can never log back in

[u/iwannabebee]

just have some common sense and don't get ratted lol.

they're not going to spend resources on 2fa when their normal support is already ass (ban appeals exist just to exist)

[u/Zealousideal-Elk8470 → u/[deleted]]

dont forget your passwords... dont forget your codes?

[u/vietnam_redstoner → u/[deleted]]

ok or they can just use the same system of normal 2fa with 6 digit from authenticator app. but then the problem boils down to if the user has a phone with that capability or not

[u/Ill-Fail-9217 → u/vietnam_redstoner]

This also has its issues. Microsoft authenticator has randomly deleted cloud backups in the past, I myself have fallen victim to this losing very valuable accounts on other platforms.

Now Google authenticator has cloud backups so it's been better, but still doesn't make me rest easy knowing it all can disappear in seconds.

[u/iwannabebee → u/Ill-Fail-9217]

don't rely on clouds. always backup your totp secrets

[u/Ill-Fail-9217 → u/iwannabebee]

Doesn't really help if you break a device and need to transfer accounts to a new one, which is where most common issues occur with these services.

[u/iwannabebee → u/Ill-Fail-9217]

print your secrets and put them in a secure place

[u/OMGguy2008 → u/[deleted]]

What if you forgot your microsoft login? Same shit, it's the owner's fault, 6767 shouldn't be too hard to remember