I would love to be able to have the option for Google Authentication to be integrated into your current 2-Factor Authentication system. Hypothetically, if I were to misplace or brake my phone, it would take some time for me to be able get a new device in which time I would not be able to reenter my Twitch account. I mod for channels, work with creators and would feel awful if I was not able to continue supporting and working for them as I do.

It was also just be an ease of access thing, where I have all of my current 2F Authentication already with Google Authentication, so as this isn't necessarily an essential facet to this system, it would be a nice addition to this system.

Yes, I'm aware: per the recycling policy on the website, "Once you have changed your name, the abandoned usernames will be held by Twitch for a minimum of 6 months"

But they're clearly not being recycled. I've been waiting on an old name since the policy was announced, and it had already been changed for at least a year when it was. I had changed it as part of an effort to rebrand some aspects of creation, which has changed directions since then.

Six months is absolutely a reasonable amount of time, but these names are clearly not being recycled. If you're not going to recycle them in a timely manner, please allow us some manner to request old names if available rather than telling us you can't help and we just have to wait when asked.

We third party dev's often build tools that assist with moderation actions/services for broadcasters.

We tell Moderators to enable 2FA, but we have no way to check it.

It would be useful to block Logins to our tool if 2FA is not enabled. But 2FA data is not surfaced in the API and there's no way to require a User to be 2FA during the login/oAuth loop.

I'd like to see the users endpoint(s) provide 2FA status.
I expect this to be behind the user read or openID scopes.

openID allows email verified. Why not 2fa status (for example)

Worth noting that Discords floats "mfa_enabled" in it's user API so we have precedent.

Right now people can create several accounts with just a new e-mail address (or delete an old account and create a new one). People that are harassing streamers usually does this, and it's unacceptable.

Twitch needs to do something about this, because it's gone too far. Bind accounts with a mobile number and let the owner change his/her name Once, because the name we chose 2 years ago might not be suitable today.

When a user register a new account on Twitch, they need to verify their identity with their phone number (for example sending a code via SMS that they need to enter to verify). And of course people can't just delete their account and create another one with the same number, it's locked to that specific username.

This will drastically reduce the harassment and bullying on Twitch.

Twitch requires the most insane password strength I've ever seen. I've had accounts with banks, insurers, court systems and other state/federal government websites, and yours is the only one I will never remember. You're a streaming site. It's not like you're handing out nukes.

Literally all I (and millions of others) want to do is watch streamers and comment occasionally. If the security is this high for streamers, who have jobs and contracts surrounding twitch, then fine. But I think you'd make a lot of people happy by making two separate account types, with different levels of security measures. One for users who will stream, and ones for viewers that will never stream. The latter will be thankful you've made the change, I'm nowhere near the first person to complain, and it's a very stupid reason to lose viewers/users/potential paying customers etc.

The iOS app has this annoying habit of logging me out of the app seemingly at random, and with no input at all on any other device. This is very disruptive as I have 2FA set up on my account, and to log in I have to both provide my password and an auth code that may/may not be easy to get to depending on whether I have my auth code generator to hand.

The iOS app never used to randomly log out, so the question is why is it doing it now. I'm aware of the "30 days" feature but it'll often log out well before the 30 days are up.