A discussion is underway about requiring a password before taking admin actions. vchuravy suggests this feature to prevent destructive actions by adversaries who gain access to a device with an admin login, similar to GitHub’s approach. Additionally, vchuravy mentions that implementing 2FA (two-factor authentication) would be beneficial, with the option to require 2FA before admin actions.
wolftune agrees and proposes that buttons and actions requiring admin permissions should have a distinct visual appearance to prevent admin carelessness. wolftune shares an example of a mistake where a moderator inadvertently posted a topic in a top-level category, and suggests that visual indications for special admin actions would promote extra caution.
codinghorror requests specific examples of actual mistakes and problems, which wolftune provides. The discussion highlights the need for a clear distinction between admin and non-admin tools and actions to prevent mistakes and promote a better understanding of the non-admin experience.
I was thinking that it might be beneficial to have an option to require re-entering the password, before switching into admin mode or taking admin actions.
Github as an example requires this and I think the main reason is to prevent/slow down destructive action by an adversary who gained access to a device with an admin login.
In addition, buttons and actions that require admin permissions should look different from those that do not. Ideally a similar distinction for moderator actions.
This isn’t just about security from malicious actors, it’s also about security from admin carelessness…
The first issue we’ve had just in exploring things: We have a top-level category but want everyone to post in sub-categories. There’s still a “new topic” button for moderators that looks totally normal, so they could (and did) inadvertently post a topic that normal users see but can’t respond to.
But the broader thing is the issue of wanting to give someone we trust higher level access (even full admin) but there are actions we want them to be really hesitant to do and avoid doing unilaterally unless necessary. It would just be nice to have some visual indication that something was a special admin action so they are extra careful with it.
The different views between two users are significant enough that logging in as two different users doesn’t strictly clarify what the non-admin experience is compared to admin. If a single-user could log-in and out of “admin” status, that would be cleanest way to understand the experience of non-admins.
I do think more experience will get us used to the status quo, but having this harder divide between admin and non-admin (and also mod and non-mod) tools / actions would make everything clearest to everyone.