Two-factor
An authenticator app, enrolled in two steps on purpose — nothing is kept until six digits have proved you can read it.
security → two-factor puts an ordinary authenticator app in front of the
account work that cannot be taken back.
Setting it up
- Press Add an authenticator. A code appears.
- Scan it with your app — 1Password, Authy, Google Authenticator, whichever.
- Type the six digits back.
Step 3 is not a formality. The factor is only kept once those six digits
have checked out, and closing the sheet before that deletes it. A factor nobody
has proved they can read is a lockout waiting for the next time it is asked for.
Adding a second one
Worth doing, and it goes the same way with one difference: because a factor
already exists, you are asked for six digits from it before the next code
appears. A backup authenticator is enrolled by the one you already have.
Removing one
From the same screen, and it asks for six digits from that authenticator. Being
signed in is not enough on its own: in an application with no password of its
own, a stolen cookie would otherwise be able to take your second factor off.
If you lose the device
A lost authenticator with no other way in is a conversation rather than a
button — the thing that would remove it is the thing you have lost. Two things
make that unnecessary:
- Enrol on a device you will still have next year, not the one you are about
to replace.
- Keep the recovery options your identity provider gives you — if you sign
in with Google or GitHub, their recovery is your recovery.
What it protects
The three things on this account that cannot be undone: removing this
authenticator, adding a second one, and closing the account. None of
them happen without six digits, however the session asking for them was come by.
It is not a second step at sign-in. The door is your identity provider's —
Google, GitHub, or whoever you signed in with — and the second factor that
guards it is the one you keep with them. This is the lock on what happens after
the door, which is why losing the authenticator costs you the account's
irreversible operations rather than your way in.
It does not add a second step in front of a machine you have already opened, and
it is not a second lock on the machine itself. The machine's own protection is
the certificate — short-lived, tied to one browser's key. See
what beafk can see.