Two-factor authentication¶

A password is one thing you know. Two-factor authentication adds one thing you have: a six-digit code from an app on your phone, changing every thirty seconds, asked for after your password.

It takes about two minutes to set up and it is the single biggest improvement you can make to the security of your account.

What you need¶

An authenticator app. Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, Ente Auth — any of them, they all do the same standard thing. If you already use one for your bank or your email, use that one.

Turning it on¶

1. My Settings → Security → Two-factor authentication → Set up.
2. Confirm your password. No password on your account, or none on your server? Then it asks you to prove it's you with a fresh sign-in.
3. Scan the square with your authenticator app. Can't scan — desktop app, cracked camera, phone at the bottom of a bag? There's a key underneath the code you can type in instead.
4. Type the six digits your app is now showing.

That's it. It's on.

Signing in from now on¶

Your password, then your code. Same as before with one extra step.

Signing in on your phone works the same way — the app asks for the code too, which is the point: a second factor that only guards one door isn't guarding much.

When you don't have your phone¶

Use a recovery code instead. On the code screen, choose Use a recovery code and enter one of the ten.

Each code works exactly once. The Security page shows how many you have left, and tells you off when you're running low. New recovery codes replaces the whole set with a fresh ten — do that if you've used a few, or if you've ever been unsure where the old list ended up.

If your phone is gone and so are the codes¶

Ask whoever runs your Initiative. They can clear the second factor from your account so you can sign in the way you usually do and set it up again on your new phone.

They can only remove it. Nobody, at any level, can see your key or your recovery codes — there's nothing to look up.

If your server asks for it¶

Whoever runs your Initiative can decide that everybody here needs a second factor — or just the people with server-wide roles. If that's you, you'll be asked for one the next time you open the app, with a link straight to the setup above. It takes a minute and then you're back where you were.

A passkey counts too, so if you've already got one of those you're done.

Turning it off¶

My Settings → Security → Turn off. You'll need your password (or a fresh sign-in, if you have none) and one more code — either from your app or a recovery code.

If your server asks everybody for a second factor, turning yours off means being asked for one again on your very next click. Which is either a useful thing to know or a slightly annoying way to find out.

Turning it off discards your recovery codes and signs you out everywhere else, which is deliberate: if you're turning this off because something went wrong, every other session going with it is the useful part.

Turned off from somewhere you've only just signed in, it waits two days before it happens.