[fChk]

Correctly! This feature is requested by 30% + of our customers. So by their request we have enabled it.

It's your website and you're entitled to do whatever you like with it... just don't lose sight of your user-base input. 30% sounds like a lot, but where are the rest (ie, the majority) ?... And that's NOT even the issue, I was hinting at in my previous post!

Two-factor authentication is cumbersome both for the users and for the Website admins and introducing it WITHOUT PRIOR NOTICE is -and I'm sorry to say- bad planning and the beginning of a lot of hassle on both sides of the equation.

Just to mention my side of the story (may be it will be of benefit to you as a feedback) and why I did log out right away when I was compelled to do the verification, is that the way you implemented it doesn't work for me (and may be others, who knows?!..)

Never target a specific audience and assume that everybody else will follow suite, we're far too diverse and with too many biases.

The way I would have implemented it is either make it optional with an opt-in check box for those seeking it (those 30%) OR make it a requirement (as you did) BUT versatile; meaning providing at least 2 verification methods to get everybody on board... Among them (hopefully), a second (verification) e-mail address, this one should especially work with the old-timers like us :-)

Anyway, those are just my inputs to you @Pacific Spirit, may be they will help you rethink that process. For me, for as long as there is no other way to get in that client area, your VPSes are unfortunately off-the-table.