Hi everyone.

About 7–8 years ago, EtCetera published a blog proposing the addition of Two-Factor Authentication (2FA). It was a good idea back then, but it was never implemented on Codeforces.

Since then, the landscape has changed quite a bit.

Password leaks have become much more common, phishing attacks are more sophisticated, malware that steals browser cookies and saved passwords is widespread, and AI is making social engineering attacks increasingly convincing. Simply relying on a password is no longer as safe as it used to be.

Because of that, I think it's worth revisiting the discussion—not only about 2FA, but about modern account security as a whole.

Rather than focusing on a single feature, I think Codeforces could benefit from a small set of optional security improvements that users can enable if they want additional protection.

1. Two-Factor Authentication (2FA)

This is probably the most important feature.

Supporting TOTP applications such as Google Authenticator, Aegis, Authy, or Microsoft Authenticator would prevent most unauthorized logins even if a password is compromised.

2. Trusted Devices

After successfully logging in with 2FA once, users could mark their personal device as trusted.

Future logins from that device wouldn't require another verification code, while new devices would.

3. Login Notifications

Whenever someone logs in from a new device or location, send an email including:

• Login time
• Browser
• Operating system
• Approximate location
• IP address

This would allow users to react immediately if something suspicious happens.

4. Active Session Management

A page showing all currently logged-in sessions would be extremely useful.

If someone forgets to log out on another computer or suspects their account has been compromised, they could revoke every session except the current one.

5. Recovery Codes

When enabling 2FA, users could receive a set of one-time recovery codes.

These could be used if they lose access to their authentication app, preventing them from being locked out of their own account.

6. Passkeys

Passkeys (WebAuthn/FIDO2) are becoming increasingly common and provide both stronger security and a smoother login experience than passwords.

While this may be a longer-term feature, it would be a great addition.

Why optional?

Not everyone wants additional login steps, and that's perfectly fine.

That's why I believe all of these features should be optional. Users who prefer the current experience can continue using it exactly as before, while others can choose stronger protection.

Final thoughts

I understand that implementing security features takes time and that the Codeforces team has many priorities.

However, compared to when the original 2FA proposal was posted years ago, today's threat landscape is very different. For that reason, I think this topic deserves another discussion.

What do you think?