User loses 2014 forum account to forgotten two-factor authentication

Two-factor authentication that locks out decade-old accounts

Losing a forum account isn't a financial tragedy, but it sucks. And it sucks even more when the lock keeping you out wasn't put there by you. A user who registered in 2014 has returned after years away, only to find that his account has two-factor authentication (2FA) enabled. The device it was set up on no longer exists, the passkey is gone too, and the backup codes even more so. The account isn't banned. It's simply shut behind a door whose key was lost in some digital drawer.

The affected user created a new account just to ask for help, wrote to the admin email and used the contact button. Eleven days later, nothing has changed. There is no response. His case isn't unique: in the same thread, at least two other people describe losing old accounts for similar reasons, one of them after a previous ban and a failed recovery caused by problems with the associated email.

What 2FA is and why it leaves old accounts with no way out

Two-step verification is a second lock: in addition to the password, it requires a temporary code generated by an app, a text message or a physical key. Its purpose is to stop a third party from getting in with just a stolen password. The problem arises when the second factor is lost: without the device, without the backup codes and without an alternative recovery route, the account becomes inaccessible even to its legitimate owner.

On large platforms, that rescue is handled through identity verification, an alternative email or security questions. On small forums running outdated software, it isn't. The most repeated answer in the thread is that the email change system doesn't work and the administration doesn't reply. Some argue that the platform has been stuck in the technical state of more than a decade ago, and that the surprising thing is that it's still up and running.

The problem isn't 2FA, it's having no one on the other end

The discussion quickly shifts to the underlying diagnosis. Some participants point out that the flaw isn't in the security itself, but in the absence of support: with no active administrators, any protective measure becomes a trap for the very user it's meant to protect. Others argue the opposite: enabling complex measures on an unmaintained service is a decision that backfires on whoever made it.

The affected user insists he never enabled anything. He can't prove it, and that's the crux: without access to the account's security panel, the claim rests on his word alone. He has offered privately to provide his username, associated email and any data to prove ownership. Nobody has asked for it yet.

What happens when the recovery email fails too

The second front is email. Several messages describe the same pattern: an old account, an expired or inaccessible email address, and an address change system that doesn't respond. Without a working recovery email, the normal rescue route closes, leaving only manual intervention by an administrator. Who, in this case, never shows up.

The affected user has publicly called out the site's owner several times. He has tried the polite tone, the insistent one, and the one that borders on insults. None of them has worked. His stated plan is to keep going until he recovers the account, accepting the risk of losing the new one too.

---

The most reasonable prediction, given the available information, is that the 2014 account won't be recovered. Not because it's technically unrecoverable, but because recovering it requires someone with the permissions to spend ten minutes on it that nobody seems willing to spare. If that administrator ever shows up, the case will be resolved in an afternoon. If not, the affected user will keep posting from a new account with the feeling of talking to himself. And he has a point.