Some sort of hacking prevention system.

We currently have 2 systems in place.

The first is called Sythe Verified. This lets users verify a phone number to add a small level of security to their account. The issue with this is that services like Google Voice make it possible for users to provide disposable phone numbers and get verified. This service is not available to users, although the system is implemented and does work. We were planning on charging a $5 verification fee for people to use this service. The idea behind the fee is that people tend not to want to throw away money (for the most part) and to cover our costs for the service. We basically decided not to open this to the public because we didn't think it really added much in terms of verifying accounts and it didn't add any additional security to accounts themselves.

The second system we have is Duo Security. Duo is what Verts mentioned; it's a two-factor system. All admins have to use Duo to log into Sythe.org. So when I try to log in, I have to either accept the login on my phone, enter a code from an SMS, or answer a phone call and confirm the login. The user chooses how they want to authenticate each time they log in. This system works really well and means you need a user's phone to get into their account. An important thing to note with Duo is that it works with BOTH landlines AND mobile phones. With landlines you can only do authentication by phone call though, no SMS or Mobile Push.

The code I wrote to integrate Duo could more than handle every user of the forum. The issue is the cost. Duo is free for up to 10 users which is why we only have admins using it. If you add more users, you pay a fee per user per month. The fee is generally around $3 per user. So, if we had even 1,000 people on it, it could turn into $3,000 per month... This is obviously not a cost we want to cover.

The option we have with Duo is to charge users the $3/month to have their account Duo-enabled. We can certainly do this, but the issue is that a lot of people won't want to pay for it. Although, any respectable market user with decent sales can surely afford the $3/month and would probably take part.

I can discuss opening Duo to others for a fee (maybe $3/mo, maybe a little more) with Sythe and see what he thinks. I would have to do some coding to automate the purchasing/activation/deactivation process but that shouldn't be an issue...

Post your thoughts if you like, I don't know how long it'll take for me to have a proper discussion with Sythe.