Two-factor
An authenticator app, enrolled in two steps on purpose — nothing is kept until six digits have proved you can read it.
security → two-factor puts an ordinary authenticator app in front of the
account work that cannot be taken back.
It is not a second step at sign-in. The door is your identity provider's —
Google, GitHub, or whoever you signed in with — and the second factor guarding
that door is the one you keep with them. This is the lock on three things that
happen after the door: removing this authenticator, adding another, and
closing the account.
Setting it up
- Press Add an authenticator. A code appears.
- Scan it with your app — 1Password, Authy, Google Authenticator, whichever.
- Type the six digits back.
Step 3 is not a formality. The factor is only kept once those six digits
have checked out, and closing the sheet before that deletes it. A factor nobody
has proved they can read is a lockout waiting for the next time it is asked for.
Adding a second one
Worth doing, and it goes the same way with one difference: because a factor
already exists, you are asked for six digits from it before the next code
appears. A backup authenticator is enrolled by the one you already have.
Removing one
From the same screen, and it asks for six digits from that authenticator. Being
signed in is not enough on its own: in an application with no password of its
own, a stolen cookie would otherwise be able to take your second factor off.
If you lose the device
A lost authenticator with no other way in is a conversation rather than a
button — the thing that would remove it is the thing you have lost. Two things
make that unnecessary:
- Enrol on a device you will still have next year, not the one you are about
to replace.
- Keep the recovery options your identity provider gives you — if you sign
in with Google or GitHub, their recovery is your recovery.
What it protects
The three things on this account that cannot be undone: removing this
authenticator, adding a second one, and closing the account. None of
them happen without six digits, however the session asking for them was come by.
Losing the authenticator therefore costs you those three, not your way in.
It is not a lock on a machine either. The machine's own protection is the
certificate — short-lived, tied to one browser's key. See
what beafk can see.