All major browsers are making major moves to support WebAuthn which is a standardized way to communicate with U2F keys like those made from Yubico, Understandable some browsers currently support it more than others and some have it enabled by default while some others have it disabled by default, however the end goal from all of the browser maintainers is to fully enable and support it.
As a forum admin, I feel like all good forum software should come by default with strong security features like TOTP Two Factor and now U2F since browsers are supporting it. The lack of two-factor authentication of any kind makes me worry that someday someone may steal my credentials or another admins credentials and do some real damage.
I'm open to discussion on the best way to do this, I am aware that there is already a two-factor authentication plugin, however, implementing good security should not fall on the shoulders of plugin developers especially since it adds another layer of possible attack as the plugins are separate from the core and are using APIs to get and send information to/from the core.
