# Two-factor

> An authenticator app, enrolled in two steps on purpose — nothing is kept until six digits have proved you can read it.

**security → two-factor** puts an ordinary authenticator app in front of the
account work that cannot be taken back.

## Setting it up

1. Press **Add an authenticator**. A code appears.
2. Scan it with your app — 1Password, Authy, Google Authenticator, whichever.
3. **Type the six digits back.**

Step 3 is not a formality. The factor is only **kept** once those six digits
have checked out, and closing the sheet before that deletes it. A factor nobody
has proved they can read is a lockout waiting for the next time it is asked for.

## Adding a second one

Worth doing, and it goes the same way with one difference: because a factor
already exists, you are asked for six digits from it **before** the next code
appears. A backup authenticator is enrolled by the one you already have.

## Removing one

From the same screen, and it asks for six digits from that authenticator. Being
signed in is not enough on its own: in an application with no password of its
own, a stolen cookie would otherwise be able to take your second factor off.

## If you lose the device

A lost authenticator with no other way in is a conversation rather than a
button — the thing that would remove it is the thing you have lost. Two things
make that unnecessary:

- **Enrol on a device you will still have next year**, not the one you are about
  to replace.
- **Keep the recovery options your identity provider gives you** — if you sign
  in with Google or GitHub, their recovery is your recovery.

## What it protects

The three things on this account that cannot be undone: **removing this
authenticator**, **adding a second one**, and **closing the account**. None of
them happen without six digits, however the session asking for them was come by.

**It is not a second step at sign-in.** The door is your identity provider's —
Google, GitHub, or whoever you signed in with — and the second factor that
guards it is the one you keep with them. This is the lock on what happens after
the door, which is why losing the authenticator costs you the account's
irreversible operations rather than your way in.

It does not add a second step in front of a machine you have already opened, and
it is not a second lock on the machine itself. The machine's own protection is
the certificate — short-lived, tied to one browser's key. See
[what beafk can see](https://beafk.app/docs/what-beafk-can-see.md).

---

beafk documentation · Security and privacy · https://beafk.app/docs/two-factor

In this section:
- What beafk can see — https://beafk.app/docs/what-beafk-can-see.md
- Signing in — https://beafk.app/docs/signing-in-to-beafk.md
- Two-factor — https://beafk.app/docs/two-factor.md (this page)
- Your browsers — https://beafk.app/docs/your-browsers.md
- Deleting your account — https://beafk.app/docs/deleting-your-account.md

Every page, one line each: https://beafk.app/docs/llms.txt
All of it in one file: https://beafk.app/docs/llms-full.txt