On: Ask HN: Best practices for stolen session detectio...

[chrisfarms]

This is where you want 2FA really.

Each time the user logs in from a new "client" ask for a 2FA code from something like their phone.

Things like Authy and Google Authenticator make this relatively painless to implement.

[stephanos2k → chrisfarms]

We already implemented 2FA, but it's not yet forced for everyone. You don't want to patronize your customers ;)