With the ongoing outbreaks of follow and hate bots "raids", the creation of multiple accounts is simply too easy to abuse on the platform. Creating an account on Twitch does not require an authentic email address before using its services: watching content, following a streamer, sending messages in streamers chats, modifying the account details, etc.

Many streamers are being harrassed by bots and "IP Grabbers" by:
- Mass following streamers with inappropriate names and account details;
- Mass spamming chats with obscene languages and characters (ex: racism, homophobia, transphobia, nazi, etc..);
- Having extensions on their user profile which allows them to grab the IP Address of Twitch users, and broadcasting them.

At the moment, when creating an account, you do not need an authentic email address and you are not required to verify the account since there is a function to verify at a later time with "Remind me later" (Example of account creation: https://youtu.be/1waYtIUHkz4)

My proposition is the following:
Before using any of Twitch services, the account must be verified by email, and there should not be any way to by-pass this verification process. To sign-up to Twitch, the user should be inserting their email address, in which a one-time registration link could be sent out to.

Doing this will slow down the creation of fake accounts used to mass follow & mass hate streamers.

There should definitely be an option to log out of all devices. Even if you log out from one device, or change your password, you will still be logged in on all devices you haven't logged out from. I really tried to find an option to log out of all but couldn't find one.

I found this "bug" when I logged out and changed my password. A few days later my friend messaged me that he still has access to my twitch (I was on his computer and forgot to log out). It's not a huge problem for me because I have nothing sensitive on my account. But still, I have never seen a website that keeps your account logged on all devices after changing the password. Twitch should force log out after changing password, at the very least have an option to log out of all.

Twitch requires the most insane password strength I've ever seen. I've had accounts with banks, insurers, court systems and other state/federal government websites, and yours is the only one I will never remember. You're a streaming site. It's not like you're handing out nukes.

Literally all I (and millions of others) want to do is watch streamers and comment occasionally. If the security is this high for streamers, who have jobs and contracts surrounding twitch, then fine. But I think you'd make a lot of people happy by making two separate account types, with different levels of security measures. One for users who will stream, and ones for viewers that will never stream. The latter will be thankful you've made the change, I'm nowhere near the first person to complain, and it's a very stupid reason to lose viewers/users/potential paying customers etc.

Reduce the amount of cooldown after a name change, I have had to wait for 6+ months to get my name changed after I accidentally changed my name. I didn't get a reply from support after 6 months either, so I had to wait it out.
Even when you change your name you might not even be able to get the name back, which is ridiculous in my opinion. Having to wait 6+ months to get your name back and yet not be able to get it is something that needs to be changed when I accidentally changed my name the Twitch.tv website crashed at the time and that's why I had to refresh the site and then it was logged into the wrong account, so it changed my name on my main account and not my alt. Therefor stuff like this should be reduced so it won't happen to anyone again.

The recycle program needs a massive overhaul.

There are far to many people waiting on unused usernames that are not released in a timely fashion.

I have been watching two names for years now. One is simply completely inactive with zero information on the profile and has never followed anyone, for years. That account also has never responded to private messages to even suggest someone logged in. **** I'd buy their account name from them if there was anyway I could contact them.

The other has the "Unless you have a time machine." message and may be an old twitch staff, or previous partner, but i have no way of knowing that. Can't they supply some reason to why I can't change to that name?

Such as: "This username is unavailable and is exempt from the recycle program"

Then in the FAQ they can just state the names that fall into this category are the old staff, partner.. etc names. So we know we won't get it. Transparency! And it wouldn't be difficult, Twitch I'm sure already has a list of names it will not release in its database, just tell us why.

I would like to suggest that there be way when we go to change our name and it says its "unavailable" for name change, that we can request a flag on it. That it can then be checked for activity and if it is actually inactive within the username recycle programs guidelines it can be put in an upcoming recycle. I'm sure this can be automated, Twitch can see if a name has logged in within six months or a year and if not then flag it, and actually do this, not like right now where inactive names MAY be recycled but probably won't be in any timely manner.

Inactive accounts under threat of recycle don't have to be deleted, you could just append the name with a bunch of random characters in case the owner comes back and you can be sure to send out multiple emails letting them know what is about to happen if they don't log in. Though this would defeat the purpose of clearing up space due to inactive accounts, at least you wouldn't be worried about someone not returning later because their name is gone.

They should also in some way be required to actually use the name. Why are some names taken but are not in use? Is there protection from possible name sellers? (Not that i've ever seen one for Twitch but its common in other areas, such as website urls, mmos usernames, social media handles) What if someone has taken a name and only logs in once a year on that alt account but that account has zero activity, they don't chat or watch any videos? Is that fair or right? Why is that allowed? Shouldn't that name be available for someone who will use it?

The current system suggests that inactive accounts will be recycled but it could take as little as six months or it could take years. We have no way of knowing when that will be or even if the name we want is eligible for recycle. I had a **** of time just getting twitch to tell me if Curse usernames from when Twitch bought Curse and automatically created accounts for them would be eligible to recycle. I was told all those names have already been recycled, but it took multiple emails and explaining on my end as the twitch staff responding just wanted to send me copy paste responses that never addressed my question.

Of course partners/affiliates and old staff names should be exempt from this to avoid possible fraud/impersonation.

First of all, good job on implementing non-Authy, non-SMS 2FA!

That being said, there's still a major hole in your 2FA implementation, and that's requiring a user to set up SMS authentication before they can set up other forms of 2FA. Unless I've missed something huge, whenever I try to set up 2FA on Twitch, I get directed to put in my phone number first. There's no prompt I can use to skip this step.

This is completely counter to how a lot of other sites do 2FA, where SMS authentication is an option, not a requirement. You can completely ignore SMS authentication and just use a standard TOTP code to set up Google Authenticator, etc. I would like to see Twitch adopt this practice as well: instead of requiring us to put in our phone number first, please just give us a list of 2FA options and let us pick a method without requiring the others. Or at least give us the option to set up SMS, set up an alternate 2FA method, and then remove SMS afterwards.

Not requiring SMS is important for several reasons:

• It's one of the most insecure forms of 2FA. Relatively speaking, it's significantly easier to intercept a SMS or gain control of someone's number than it is to crack a TOTP token. (See this article for examples: https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/) Requiring SMS means that everyone's account now has that "weakest link," even if they use a TOTP app.

• Not everyone is comfortable giving their phone number to Twitch. Phone numbers are used for all sorts of things these days, including sensitive accounts. Some people just might maintain a strict online/offline life separation, and are wary of their phone number being leaked. Even if Twitch never intentionally reveals SMS authentication numbers to the public, hacks can and do happen.

• Not everyone has a phone, or has a phone capable of receiving text messages, or a permanent phone number, or a phone that's recognized by Twitch as legitimate... Some people are still on landline for financial reasons. Some people are using small, alternative carriers like Republic Wireless or Google Fi, which get flagged as VoIPs. (Which Twitch does not allow for SMS authentication, despite those numbers being able to receive text messages.) The possibilities go on and on.

I'm sure there are many other reasons why requiring SMS authentication is a bad idea. I'm not asking for it to be removed entirely, but we should at least have the option of NOT using it.

Thanks for reading, and do correct me if this option already exists and I somehow missed it.

(See also: https://twitch.uservoice.com/forums/310228-account-management-e-g-login-connections-pass/suggestions/35025769-an-option-to-disable-sms-authentication-fallback-a)

I've seen this requested feature a lot, option to add a display name? (just like with Twitter, there's a display name, and an @username)

Good way to deal with username snipers, generic words & common names such as "Jake" or "Jacob" are already being used of course, but if someone named "Jacob" creates a username such as /Jacob_535455 then it just looks messy for a channel name, so yeah, a display name should be an option too (it's already on Facebook, Twitter, YouTube, Instagram, Reddit, Steam, you name it, so it'd be a good idea for here too)

For LIVE notifications, it should still say "@Jacob_535455 just went LIVE" (or something similar) to prevent confusion with someone else named Jacob

I am in agreement with people requesting a reduction on the time before you're able to change your username. Even if i have to wait 2 months before i can change it to something else, I've tested out my current username, as of posting this, and have discovered i hate it. If you could revert a user name change in the first 24 hours at least, even if i had to wait 2 months until i try again, it would solve a lot of people's problems with it. I also hate how there's no way of testing out a username without having to commit to it for 2 months to begin with.