Single post in Two-Factor Authentication

That's a fair question, but the answer is that it wasn't really thought to be necessary. But PFQ has grown quite significantly over the years and things have changed - most importantly, 2FA standards have been thoroughly hashed out and so it was relatively easy to implement. I say "relatively easy"... that's a lie. It was torture. I couldn't find a single example of how to actually implement it; I had to go all the way to the source documents laying out the specification, and then had to manually implement it myself. Even the base-32 encoding part of the algorithm had to be done manually. And basically all of the examples out there completely skipped over how to generate a secret key, instead using a fixed "passcode" for all users! And debugging it was an absolute nightmare because how do you debug something that is specifically designed to give basically random numbers? There's no indication of "how close" I am to implementing it correctly, until after some tweaks it just magically gave me the same numbers that Google Authenticator said it should give me. Anyway... It's here now. We can all enjoy the benefits, and I never ever have to touch that code again, thank goodness!