• As everyone says, you could just put a strong password on your account, and change it often. But if that password gets leaked, your account is done for. The hacker can just login, change your account email, and boom, you can never get back access to your account with all your hard work in the form of your projects and that impressive forum post count. Now literally all you can do is hope that that account gets terminated, which usually it doesn't. For whatever reason.
  
  
• Being on Scratch for a few years, I've seen like atleast 5 people on Scratch get hacked. And I can confidently say others have seen more too. Just one example I can think of is coco7nut (I don't think he actually died). Basically, account security on scratch just feels so overlooked.
  
  
• If you add 2FA and less accounts get hacked, you'll probably get a whole lot less support tickets of people whose accounts got hacked and are begging to try to get their accounts back.
  
  
• Nowadays, 2FA is basically essential for any big websites with an account system where your account actually matters. The fact that Scratch still doesn't have it makes it feel so outdated. Many other websites, some open-source, have already implemented 2FA years ago. One example is Wikipedia/MediaWiki, which has had this extension implementing 2FA for over a decade now. This proves that it's not impossibly hard to add 2FA.
  
  
• Scratch has this philosophy that things need to be super simple because Scratch is for 7 year olds and stuff. I understand that, but for those 7 year olds, if they don't want to set up 2FA then they don't need to.
  

ninjahanzo wrote:

(#2)
Dupey the snowman was a jolly helpful soul