With the ongoing outbreaks of follow and hate bots "raids", the creation of multiple accounts is simply too easy to abuse on the platform. Creating an account on Twitch does not require an authentic email address before using its services: watching content, following a streamer, sending messages in streamers chats, modifying the account details, etc.

Many streamers are being harrassed by bots and "IP Grabbers" by:
- Mass following streamers with inappropriate names and account details;
- Mass spamming chats with obscene languages and characters (ex: racism, homophobia, transphobia, nazi, etc..);
- Having extensions on their user profile which allows them to grab the IP Address of Twitch users, and broadcasting them.

At the moment, when creating an account, you do not need an authentic email address and you are not required to verify the account since there is a function to verify at a later time with "Remind me later" (Example of account creation: https://youtu.be/1waYtIUHkz4)

My proposition is the following:
Before using any of Twitch services, the account must be verified by email, and there should not be any way to by-pass this verification process. To sign-up to Twitch, the user should be inserting their email address, in which a one-time registration link could be sent out to.

Doing this will slow down the creation of fake accounts used to mass follow & mass hate streamers.

First of all, good job on implementing non-Authy, non-SMS 2FA!

That being said, there's still a major hole in your 2FA implementation, and that's requiring a user to set up SMS authentication before they can set up other forms of 2FA. Unless I've missed something huge, whenever I try to set up 2FA on Twitch, I get directed to put in my phone number first. There's no prompt I can use to skip this step.

This is completely counter to how a lot of other sites do 2FA, where SMS authentication is an option, not a requirement. You can completely ignore SMS authentication and just use a standard TOTP code to set up Google Authenticator, etc. I would like to see Twitch adopt this practice as well: instead of requiring us to put in our phone number first, please just give us a list of 2FA options and let us pick a method without requiring the others. Or at least give us the option to set up SMS, set up an alternate 2FA method, and then remove SMS afterwards.

Not requiring SMS is important for several reasons:

• It's one of the most insecure forms of 2FA. Relatively speaking, it's significantly easier to intercept a SMS or gain control of someone's number than it is to crack a TOTP token. (See this article for examples: https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/) Requiring SMS means that everyone's account now has that "weakest link," even if they use a TOTP app.

• Not everyone is comfortable giving their phone number to Twitch. Phone numbers are used for all sorts of things these days, including sensitive accounts. Some people just might maintain a strict online/offline life separation, and are wary of their phone number being leaked. Even if Twitch never intentionally reveals SMS authentication numbers to the public, hacks can and do happen.

• Not everyone has a phone, or has a phone capable of receiving text messages, or a permanent phone number, or a phone that's recognized by Twitch as legitimate... Some people are still on landline for financial reasons. Some people are using small, alternative carriers like Republic Wireless or Google Fi, which get flagged as VoIPs. (Which Twitch does not allow for SMS authentication, despite those numbers being able to receive text messages.) The possibilities go on and on.

I'm sure there are many other reasons why requiring SMS authentication is a bad idea. I'm not asking for it to be removed entirely, but we should at least have the option of NOT using it.

Thanks for reading, and do correct me if this option already exists and I somehow missed it.

(See also: https://twitch.uservoice.com/forums/310228-account-management-e-g-login-connections-pass/suggestions/35025769-an-option-to-disable-sms-authentication-fallback-a)

re: https://blog.twitch.tv/en/2021/09/29/securing-your-chat-with-phone-and-email-verification/

The FAQ suggests alternatives to mobile verification, VOIP, et al., are not good enough for verification; i.e., too cheap to spoof.

I'm an affiliate in long standing, can that fact not be verification that I can be trusted not to make duplicate accounts? Twitch has my tax ID, I'm pretty sure that they're pretty sure who I am. I do use Authy (and other online services) for verification, but I do not use cell networks ("mobile").

It makes little sense that Twitch has approved Us affiliates to represent their Terms of Service well enough to pay us, yet I'm not trusted enough to speak in Phone Verified Chat channels.

   I am suggesting an idea which would utilize having set up 2FA using a phone number to count for chat verification as well.
   I was in a raid but when I got to the destination streamer I couldn't send messages in the chat even though I had followed that channel.  I got a message saying that I couldn't chat because my account wasn't verified.  I clicked on the little info icon, and it explained it and I was able to get into chat fine.
   I was confused though, because I have had my Twitch account set up with 2FA using my phone number for a while, easily more than 3 months.  I thought that would suffice as enough for having my account verified.  I was really confused when the system gave me the verification code to use before I had entered my phone number to the system.  I know that's because of how Google Authenticator works, but still confusing that it worked.
   I'm just thinking that, because the layers of security are identical for setting up 2FA and chat verification, fulfilling one requirement could be counted as fulfilling the other.  I don't think this would decrease security at all but it would improve the user experience.  I know that it would take some coding work to make that happen, but I think the time would be worth it.

I am in agreement with people requesting a reduction on the time before you're able to change your username. Even if i have to wait 2 months before i can change it to something else, I've tested out my current username, as of posting this, and have discovered i hate it. If you could revert a user name change in the first 24 hours at least, even if i had to wait 2 months until i try again, it would solve a lot of people's problems with it. I also hate how there's no way of testing out a username without having to commit to it for 2 months to begin with.

EN: I want every change to contract to be sent to the email address associated with the Affiliate / Partner account. For example, when an e-mail or other data has been changed in the contract, information should be sent to the e-mail assigned to the account. Streamers are losing money through data leaks, as I am because someone has changed my email to make a payment and Twitch is not willing to do anything about it or give me my money back.

PL: Chcę, aby każda zmiana w umowie była wysyłana na adres e-mail przypisany do konta Towarzysza/Partnera. Na przykład gdy e-mail lub inne dane zostały zmienione w umowie to powinna zostać wysłana informacja na e-mail przypisany do konta. Streamerzy tracą pieniądze przez wycieki danych, tak jak ja, ponieważ ktoś zmienił mój e-mail w celu dokonania płatności, a Twitch nie chce nic z tym zrobić ani oddać mi pieniędzy.

Problemas con formulario de Afiliado
Al completar el formulario, en el paso 4 donde se registra la forma de pago, al llegar al ultimo paso y dar siguiente la pagina se actualiza y pide nuevamente verificar la cuenta, y el paso 4 no se completa y asi se mantiene pues no me permite llenarlo ya que llegando al final la pagina se actualiza y vuelve a pedir verificación. Arreglen eso porfa ya llevo una semana desde que consegui el logro de afiliado y no puedo aun llenar ese formulario, y no... no se trata de un problema en los datos ingresados.