Account Breach incident

I'm glad you're taking action against this! A quick little feature suggestion that may potentially help is some sort of password strength bar? For example if you put in a five letter password when resetting/making your account it'll say "password strength: weak". A lot of social platforms do that and while it can't help if people choose weak passwords, it can definitely give new and old users an idea of how secure they're making their account. Apologies if anybody already suggested this here, just put me down in the yes vote if you're thinking about it already :p Quick edit: I'm not sure exactly what 2FA is but I assume it's two step verification (from what I saw online, looking it up)? If you do decide to implement it into pokèfarm, maybe make it so that people can verify being logged in through email instead of only the phone notification, since it is a requirement to have when making an account. What if you can also give people the option to add/remove their number/email in options or somewhere, with some sort of pin (that the user made) or email/phone verification to change/remove the login verification option. (I know I shouldn't call out any site here but to make what I mean more understandable, I'm thinking what roblox does when logging in and changing the verification login method.)

Thank you for looking into 2FA! While it certainly won't help everyone, what matters is that it'll help the people who care about their own account and the security of it. People should be able to feel more at ease about the security of their account. In the given examples, there's honestly nothing you can really do about those people, I don't think that's a problem you specifically need to solve. Account security is ultimately something that requires both the user and the site to work together in unison. If there's people who give away their information with ease, the only one to blame in that situation is themselves. It's a learning experience that everyone has to go through eventually, the blame does not go to the site in a case like this. As for those who don't have a phone and can't access 2FA, I actually happen to be one of those people and as an alternative I've used both Authy and WinAuth on my computer and they seem to work perfectly fine. Some people will indeed see it as a nuisance and avoid using it for that reason, I can recall people saying something along those lines the last time we had a discussion involving account security. However, those who care the most about their accounts will be able to feel more at ease with 2FA. I believe that is what matters most. Having an additional layer of security can only be a good thing.