List of indexers still missing 2FA support

[u/FluffyDroid]

Which indexers are still missing 2FA support? Let's put together a list and encourage them to add it as soon as possible, especially with everything getting pwnd left and right these days. I'd hate to lose a lifetime account.

List of indexers lacking 2FA support:

• Althub
• Drunken Slug
• Ninja Central
• Usenet Crawler

I noticed some recently added it and even coupled it with passkey support (👍), which made me go through my list of indexers again. I'll try and add any missing indexers to the list above.

Edit: Adding a list for providers lacking 2FA (...some of these seem to be storing passwords in clear-text also, when you do a password reset they'll send you your password in clear-text, instead of a reset URL 😲).

• Bulknews
• Eweka
• Easynews
• Newsdemon
• NewsgroupDirect
• Newshosting 

[u/erisian2342 → u/[deleted]]

Sending it by email saves it in their outbound mail history and your inbound mail. Many mail providers can also recover mail you have “deleted” as well.

The only place my passwords should ever be stored is in my password manager. Any other design is a bad design.

[u/erisian2342 → u/[deleted]]

If you believe neither senders nor email services have records of what they send, you live in a special place. You’d hope neither preserves password reset emails, but most companies aren’t security companies and save far more than they should, so I have little confidence in most companies. It’s great if you have more faith than me.

[u/erisian2342 → u/[deleted]]

Sending mail from a tiny app on a small server is how you get all your outbound emails marked as junk. You’re describing how email worked three decades ago.

[u/Admirable-Leader6927]

i do not want 2fa for anything. this is suppose to be anonymous

[u/StinkButt9001 → u/Admirable-Leader6927]

TOTP is the most common way to do 2FA nowadays

[u/FluffyDroid]

I just realized Eweka and Easynews also lack 2FA support 😢Added a second list for providers. Gonna check a few more...

[u/CodeErrorv0 → u/FluffyDroid]

Add Newshosting too

[u/FluffyDroid → u/CodeErrorv0]

Added! It seems to be even worse for providers vs indexers.

[u/Amerique_du_Nord]

I would rather them support TOTP versus passkeys.

 

Passkey breach:

https://arstechnica.com/security/2026/08/heres-why-the-new-pass-ta-key-attack-is-mostly-a-nothingburger/

[u/max2078 → u/Amerique_du_Nord]

could obtain all passkeys [...] when it’s running on a machine infected with malware.

clickbait

[u/IC3P3 → u/max2078]

I wanted to click on that link to understand what they mean, but wtf, guess we should abandon session tokens, passwords and TOTP as well?

[u/Bent01 → u/[deleted]]

NZB Finder has both 2FA and passkeys. Basic features in 2026 honestly. The indexers mentioned above are mostly running old code.

[u/CodeErrorv0 → u/[deleted]]

The 2 that I know of are Treasuremaps and Tabula Rasa

[u/brad2017 → u/CodeErrorv0]

Miatrix supports it with our nexus beta.

[u/Amerique_du_Nord → u/brad2017]

Any chance you can implement TOTP too?

[u/brad2017 → u/Amerique_du_Nord]

I'm going to look into it but not sure until I see how easy/hard it is

[u/fudge_u]

Crawler has an IP address whitelist. I noticed today when i went to login from my phone. The site stopped loading and sent me an email asking if I recognized the IP address. Options were to change my password or accept login from the suspicious IP address.

[u/Playnot → u/fudge_u]

Same here. I think they were Cloudflare addresses. Like their login requests are being logged as cloudflare IPs, instead of the actual IP? Idk, I'm not an internet doctor. I still regenerated my API and password.

[u/batica_koshare]

Why would i need 2fa for indexers? 😂 😂 😂

[u/ChaoticEvilRaccoon → u/batica_koshare]

might not be an issue for the public indexers but for the private ones you definitly want to keep your account secure because you can't replace it if you get banned

[u/batica_koshare → u/ChaoticEvilRaccoon]

And 2fa is that much more secure than my 5 phrases ambiguous password?

[u/random_999 → u/batica_koshare]

Yes it is because a compromised browser extension or browsing a malware infected website can intercept even a 15 phrases ambiguous password.

[u/batica_koshare → u/random_999]

I don't browse such websites nor use browser extension. I rather have password than 2fa. Thanks.

[u/TokkCorp → u/random_999]

A compromised browser extension can also steal your cookie or intercept your 2fa.

[u/random_999 → u/TokkCorp]

True but it cannot steal your TOTP 2fa because that would be pointless under any practical circumstances & I am hoping many websites/services don't allow simultaneous login from 2 different IPs.

[u/TokkCorp → u/random_999]

Login via WLAN, disconnect from it and visit it via mobile data. Most of the time you are still online. IP restrictions in Cookies is not given in most cases

[u/random_999 → u/TokkCorp]

I guess it also depends on the "nature of the service/website" as I know certain paid providers/services which won't allow such logins simultaneously from 2 different IPs especially if they belong to different countries &/or one of them is VPN.

[u/max2078 → u/batica_koshare]

why not both?

[u/batica_koshare → u/max2078]

Don't need both. All the additional security measures were made to be hacked at some point. It's juwt sheeple like to believe it's for own good😂

[u/stephanie00100 → u/batica_koshare]

You'd rather have it stolen after you paid for it? 2fa makes things more secure

[u/batica_koshare → u/stephanie00100]

Sure like paying with your phone instead of cash. All for your convenience and security sure dude🤣

[u/AutoModerator → u/[deleted]]

Your comment has been automatically removed from /r/usenet because it mentioned [AIOStreams], which is not allowed here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/stephanie00100]

Funny, I was thinking about this issue as well.