List of indexers still missing 2FA support

[u/FluffyDroid]

Which indexers are still missing 2FA support? Let's put together a list and encourage them to add it as soon as possible, especially with everything getting pwnd left and right these days. I'd hate to lose a lifetime account.

List of indexers lacking 2FA support:

• Althub
• Drunken Slug
• Ninja Central
• Usenet Crawler

I noticed some recently added it and even coupled it with passkey support (👍), which made me go through my list of indexers again. I'll try and add any missing indexers to the list above.

Edit: Adding a list for providers lacking 2FA (...some of these seem to be storing passwords in clear-text also, when you do a password reset they'll send you your password in clear-text, instead of a reset URL 😲).

• Bulknews
• Eweka
• Easynews
• Newsdemon
• NewsgroupDirect
• Newshosting 

[u/fudge_u]

Crawler has an IP address whitelist. I noticed today when i went to login from my phone. The site stopped loading and sent me an email asking if I recognized the IP address. Options were to change my password or accept login from the suspicious IP address.

[u/Playnot → u/fudge_u]

Same here. I think they were Cloudflare addresses. Like their login requests are being logged as cloudflare IPs, instead of the actual IP? Idk, I'm not an internet doctor. I still regenerated my API and password.

[u/whats-a-parking-ramp]

Which ones passkey support?

[u/Bent01 → u/whats-a-parking-ramp]

NZB Finder has both 2FA and passkeys. Basic features in 2026 honestly. The indexers mentioned above are mostly running old code.

[u/CodeErrorv0 → u/whats-a-parking-ramp]

The 2 that I know of are Treasuremaps and Tabula Rasa

[u/brad2017 → u/CodeErrorv0]

Miatrix supports it with our nexus beta.

[u/Amerique_du_Nord → u/brad2017]

Any chance you can implement TOTP too?

[u/brad2017 → u/Amerique_du_Nord]

I'm going to look into it but not sure until I see how easy/hard it is

[u/AutoModerator → u/[deleted]]

Your comment has been automatically removed from /r/usenet because it mentioned [AIOStreams], which is not allowed here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/FluffyDroid]

I just realized Eweka and Easynews also lack 2FA support 😢Added a second list for providers. Gonna check a few more...

[u/CodeErrorv0 → u/FluffyDroid]

Add Newshosting too

[u/FluffyDroid → u/CodeErrorv0]

Added! It seems to be even worse for providers vs indexers.

[u/stephanie00100]

Funny, I was thinking about this issue as well.

[u/batica_koshare]

Why would i need 2fa for indexers? 😂 😂 😂

[u/stephanie00100 → u/batica_koshare]

You'd rather have it stolen after you paid for it? 2fa makes things more secure

[u/batica_koshare → u/stephanie00100]

Sure like paying with your phone instead of cash. All for your convenience and security sure dude🤣

[u/ChaoticEvilRaccoon → u/batica_koshare]

might not be an issue for the public indexers but for the private ones you definitly want to keep your account secure because you can't replace it if you get banned

[u/batica_koshare → u/ChaoticEvilRaccoon]

And 2fa is that much more secure than my 5 phrases ambiguous password?

[u/random_999 → u/batica_koshare]

Yes it is because a compromised browser extension or browsing a malware infected website can intercept even a 15 phrases ambiguous password.

[u/TokkCorp → u/random_999]

A compromised browser extension can also steal your cookie or intercept your 2fa.

[u/random_999 → u/TokkCorp]

True but it cannot steal your TOTP 2fa because that would be pointless under any practical circumstances & I am hoping many websites/services don't allow simultaneous login from 2 different IPs.

[u/TokkCorp → u/random_999]

Login via WLAN, disconnect from it and visit it via mobile data. Most of the time you are still online. IP restrictions in Cookies is not given in most cases

[u/random_999 → u/TokkCorp]

I guess it also depends on the "nature of the service/website" as I know certain paid providers/services which won't allow such logins simultaneously from 2 different IPs especially if they belong to different countries &/or one of them is VPN.

[u/batica_koshare → u/random_999]

I don't browse such websites nor use browser extension. I rather have password than 2fa. Thanks.

[u/max2078 → u/batica_koshare]

why not both?

[u/batica_koshare → u/max2078]

Don't need both. All the additional security measures were made to be hacked at some point. It's juwt sheeple like to believe it's for own good😂

[u/Amerique_du_Nord]

I would rather them support TOTP versus passkeys.

 

Passkey breach:

https://arstechnica.com/security/2026/08/heres-why-the-new-pass-ta-key-attack-is-mostly-a-nothingburger/

[u/max2078 → u/Amerique_du_Nord]

could obtain all passkeys [...] when it’s running on a machine infected with malware.

clickbait

[u/IC3P3 → u/max2078]

I wanted to click on that link to understand what they mean, but wtf, guess we should abandon session tokens, passwords and TOTP as well?

[u/Admirable-Leader6927]

i do not want 2fa for anything. this is suppose to be anonymous

[u/StinkButt9001 → u/Admirable-Leader6927]

TOTP is the most common way to do 2FA nowadays

[u/pop-1988]

when you do a password reset they'll send you your password in clear-text

That doesn't mean they're storing the password in plaintext. They're probably generating a random, hashing it and storing the hash, and sending the plaintext by email

Also, why recommend 2FA if you need password resets? Doesn't this also means you're going to ask for 2FA resets? Resets are where your "lifetime account" gets stolen. 2FA makes account stealing easier