Two-Factor Authentication

That's a fair question, but the answer is that it wasn't really thought to be necessary. But PFQ has grown quite significantly over the years and things have changed - most importantly, 2FA standards have been thoroughly hashed out and so it was relatively easy to implement. I say "relatively easy"... that's a lie. It was torture. I couldn't find a single example of how to actually implement it; I had to go all the way to the source documents laying out the specification, and then had to manually implement it myself. Even the base-32 encoding part of the algorithm had to be done manually. And basically all of the examples out there completely skipped over how to generate a secret key, instead using a fixed "passcode" for all users! And debugging it was an absolute nightmare because how do you debug something that is specifically designed to give basically random numbers? There's no indication of "how close" I am to implementing it correctly, until after some tweaks it just magically gave me the same numbers that Google Authenticator said it should give me. Anyway... It's here now. We can all enjoy the benefits, and I never ever have to touch that code again, thank goodness!

That's odd...is it possible that the website is just old enough that coding it to work correctly is more difficult than it should be? ...It sounds like it was more of a pain in the butt than it should've been, but at least that's over right? I feel like that is something that warrants a celebratory coffee! lol

I don't think that it's necessarily age of the site. I think it's more of the fact that 2FA doesn't have an implementation guide.

Thanks for going through foreign territory to make this happen! Glad to see we have the option for 2FA now.