Finally. Thank you.

Much thanks.

Refering specifically to TOTP vs email, TOTP makes it harder for someone to take control of you account because even if they get access to you email they still need access to you authenticator app. Since everything else is depends on you email, having a separate verification mechanism is a plus in terms of security and might make the difference between your account being compromised or not. Also TOTP codes usually last only 30 seconds while email OTPs are generally valid for a whole lot longer, giving attackers more time to do their thing. There might be some of that, depending on what apps/services you use and how much you use them.

Personally, I have been using FreeOtp+ (https://play.google.com/store/apps/details?id=org.liberty.android.freeotpplus) for a very long time without any kind of issue. There are also good options for pretty much every OS you care to name and some password managers like KeePass also support it. Just make sure you pick something that's either open source or made by a company you trust.

That's a good argument for those who still use one password for everything. I understand that, but I doubt that these people will activate the new 2FA.

Personally, I consider strong passwords, individually configured for each service/user account, to be a sufficient solution. It's actually advantageous to run a manageable mail server, as this allows you to set up individual email addresses for all services. These should be redirected, of course, because so many mailboxes would be too much work.

That might be an argument for some. In my practice, I log in, receive the 2FA email, and use the code immediately. That should also expire.

But yes, it's true. If someone else triggers 2FA and the code doesn't expire (doesn't it with GOG?), the window for attacks would be larger.
So I am not alone in this opinion :)

Yes, of course. :)

There are no companies I trust. Trust doesn't come for free. I only trust people, and only those who have earned it. So, in a case like this, the only option for me is open source. But thanks for the link, I'll take a look, just to see where the journey takes me into the future. :)

Sounds like a paradox to me.
And I also don't have a mobile phone.

Finally, thank you, GOG!

I think it's good when web service providers want to increase security. However, I personally don't see any such improvement here. That's not a negative criticism; maybe I'm just blind to the benefits. :)

Hmmmmm.....I guess an extra layer of security couldn't hurt......or could it? I am of the mind that this is potentially more troublesome than regular email/password...or email/password//2fA.

Why do I want to rely on a third-party app for my security? What if I lose access to the app? What if I lose those backup codes needed in just such a case?

More hassle and potential BS that I want no part of. As people have mentioned...this is basically throwing away any responsibility of the website admins, and putting the burden of security squarely on our shoulders instead.

Open source authenticator apps exist, also as extensions for your desktop browser. The Google and Microsoft offerings are (sadly) simply already installed for the vast majority of users, so it might lower the barrier to entry for those users if they know they won't have to install something new.
For you, as indeed for me, the benefit would be mostly theoretical, with a tiny bit of benefit from the defense in depth posture for the case where GOG itself loses control over its user database, or someone were to take over your email domain via your registrar. (Though I suspect your GOG account would be the least of your worries in such a case.)

Didn't know that. Have to look into it. Thanks for the hint. :)

That's right.

If the provider loses control, everything is lost anyway.

And as far as the account is concerned, there's always legal recourse. Within the EU, it's not quite as problematic. In the worst case, you lose access to future updates, provided you've backed up everything (which you should).

I think everyone in IT knows that absolute security is an illusion and, just like perfection, is unattainable. However, the fact remains that 2FA is more secure than standard login.

Thanks for finally modernizing this.

Edit: Switched. Glad for the choice of QR code or key. Didn't feel like setting up a new phone auth vs local computer auth.

Finally! Made the switch immediately. This will be a lot cheaper for GOG to operate, compared to sending out millions of emails every day...

THANK YOU!!!! You guys are the best <3