that would be SO cool!

Seeing this thread, I came to ask, once again, to change the way this works. I see that the Cookie Monster covered it already, but I still want to add my voice - giving a user the heads up after the fact is backwards and useless, it needs to be the other way around.

Hillary, is that you?

deleted

So I still haven't heard anything, sorry if I sound pushy I just want to try and fix this as soon as possible,

Hi, I just received the very same email, and I've wrote to the support mail.

Hope I can get my account back ASAP.

I wholeheartedly agree with that notion. There has to be an upfront notification to confirm a change before it happens to make two-factor authentication actually useful in such a scenario. Would save GOG and it's customers a lot of trouble by not having to deal with a potential mess afterwards.

Midoryu

Edited 11:12: Fixed typing error.
Edit 2 13:41: Another one... sigh.

Meh, make it optional, I like the current system although my browsers also clear all data except passwords after closing them.

Better would be to start supporting Google Authenticator

You can use a separate user account in your operating system just for logging into GOG.

Imho the benefits of 2FA outweigh the downsides. Everyone should use it, else they risk exactly this, loosing access to their account.

I just changed my e-mail address to check on this and I received a mail afterwards that begins with
"Hi Midoryu, your e-mail address was changed" and ends with "If your email address was changed without your knowledge please contact our support team."
So it seems like two-factor authentication doesn't trigger on this one.

Also GOG states this on the ORDERS & SETTINGS/LOGIN AND SECURITY page:
"Two-step login is an optional extra layer of protection for your GOG.com account. With two-step login enabled, your identity will be verified through your email address whenever you log in from a new device, browser and/or location." Only used for login apparently, nothing else.

And yes, I understood what PaterAlf was suggesting and I'm all for it, because having more options is always better than having less. It should not be the main concern, however.
While this fixes a convenience issue, what HypersomniacLive brought more insistently to the table is a glaring security issue. Since he quoted a Blue, he obviously wanted to bring this to GOG's attention (again) and I just chimed in on that, because, like him, I believe it needs to be fixed and to be focused on above all else. I myself didn't knew about it beforehand, though. (So thanks for that.)

I hope I provided a better insight of what my intentions were with that earlier post.
(and for it to appear less confusing now)

Midoryu

PS: Gonna change my e-mail back now... And don't even get to confirm it!
_________________________________________________________________________

Edited 13:48: Added GOG two-step login explanation.
Edit 2 15:04: Rephrased the text to make it more obvious that PaterAlf mentioned the whole idea, already.
(Also typing errors.)

Exactly. When an account change is attempted, one should get a verification email in order for the change to go through, not an email telling you "hey, so and so changed, if it wasn't done by you, contact support".

This is how it works on other places I have accounts. And this is how it should work here too, especially since the current "two-step login" works the way it works, which, from my understanding, doesn't affect the way account changes work.

But even if I have it wrong, since it's optional, the way account changes work should be fixed to offer protection to people that opt-out from the "two-step login" system.

In that case, I stand corrected. If two-step authentication really only affects logins and not account changes, then it's next to useless.

So I got my 'XP' by turning on 2SA - thanks for the reminder, gOg. I regularly login from three devices: my fingerprint-locked phone, our kitchen PC, and my work laptop. Only the phone login required 2SA after turning it on, and that was only the first time I visited the site. The other two simply let me in like always. Granted, I did save the log-in credentials in the browser so I previously did not need to log in each time, but shouldn't it have required authentication at least the first time I visited the site on each device after turning on the feature? Or are those other logins getting a pass because the system recognizes the location by IP address?