and my email address was changed, so I can't contact support from that email
Why not? Just send an email to support@itch.io explaining the situation.
You think they simply forget the "old" mail account and would not see the suspicous activity on that account?
Also, did you try logging in with the username instead of the email?
Makes sense.
This is at least the second thread about a situation where 2fa did not help against account theft.
It is possible to change passwords with activated 2fa, without providing the 2fa token. This is a desgin flaw. It needs to be asked every time the password is asked. Such as for password change or email change.
Those cookie stealing attacks are nasty. I wonder how they aquire the password, or if they found a way around the password as well. Or maybe they simply managed to take it from the browser database along with the session cookie.
And if this is done with session stealing, the host should ask for login again when the ip suddenly changes. Or is this prohibitive, because of people using their phone's internet and switching to different wlan all day.
It is possible to change passwords with activated 2fa, without providing the 2fa token. This is a desgin flaw. It needs to be asked every time the password is asked. Such as for password change or email change.
This is a bit tricky, we would also need to disable the ability for an account to turn off 2fa without a 2fa token, otherwise the person who hijacked the account would disable 2fa before making their changes. This could cause people to get locked out of their account. At this point though, the risks of being locked out of an account and having to contact support probably aren’t as bad as the damage a hacked account can do.
For context, changing password, email, and two-factor auth settings requires the account password. If someone is stealing a session and able to take over the account by changing its details, then they also have the account password.
You know better what is more work for support.
People losing their accounts due to hackers or people shutting themselves out of their account due to screwing up the 2fa.
It just makes 2fa less secure than one might think.
Least intrusive might be to ramp up the session hijacking detection, if possible.
