Two-factor authentication¶
Two-factor authentication asks for a second proof of identity after your password, so that a stolen or guessed password is not enough on its own to reach your account.
It is off unless your group has switched it on, and even then it is normally your own choice whether to use it. A group can make it compulsory for particular roles.
The three methods¶
You can set up any combination of three methods, and pick which one is offered first.
Authenticator app. A free app on your phone — Google Authenticator, Microsoft Authenticator, 1Password and others all work. You scan a QR code once, and from then on the app shows a fresh six-digit code every thirty seconds. It needs no signal and no network, so it keeps working on a plane or in a basement. This is the most reliable of the three.
Text message. A six-digit code is texted to your mobile. It needs signal, and it only works if your group has set up a text-message gateway; if they have not, the option is not offered at all.
Email. A six-digit code is emailed to you. Convenient, but the weakest of the three: anyone who can already read your email can complete it.
Texted and emailed codes expire after ten minutes and work only once. Codes from an authenticator app expire every thirty seconds on their own.
How often you are asked¶
You choose how long a device you trust may go without being asked again — every time you sign in, every 12 hours, daily, weekly, or monthly. Your group sets the longest gap you are allowed to choose, so the list you see may be shorter than that.
The clock is per device, and only applies to devices you explicitly ticked "Don't ask again on this device" on. Any device you did not tick is challenged every single time. Changing the setting re-times every remembered device immediately rather than at your next sign-in.
Choosing "Every time I sign in" forgets every remembered device at once.
Recovery codes¶
When you set up your first method you are given ten single-use recovery codes, shown once and never again. They are the way back in if you lose your phone. Each one works exactly once, and generating a fresh set immediately stops the old set working.
Anywhere a six-digit code is accepted, a recovery code is accepted instead.
If you have lost your phone and have no recovery codes left, an administrator cannot read your codes or bypass the check — the seed is encrypted and the codes are stored only as hashes. They can only remove the method from your account so you can enrol again.
Remembered devices¶
Ticking "Don't ask again on this device" stores a token in that browser, not on your account, and the token is only good for the gap you chose. Your profile lists every remembered device with its last-used time, and you can forget any one of them, or all of them at once, from there.
Signing out does not forget the device. Clearing your browser data does, because the token lives in that browser.
Why does it suddenly ask me again¶
- You are on a different browser, device, or a private window. The token is per browser, so a new one is always challenged.
- Your chosen gap has lapsed since you last signed in on that device.
- You cleared your browser data, which removed the token.
- You changed your interval, which re-times every remembered device.
- You, or an administrator, forgot the device from your profile.
- You removed and re-added a method, which clears remembered devices.
- Your group shortened the maximum gap, which pulls everyone's setting down to the new cap.
What two-factor authentication is not¶
- Not a password change. Your password still works exactly as before; this is an extra step after it, not a replacement.
- Not single sign-on. Signing in with Microsoft or Google is a different feature and is not affected.
- Not the suspicious activity monitor. That watches what people do once they are already signed in, and alerts administrators. This controls getting in at all. See security settings.
- Not a per-deal or per-document permission. It controls access to your account, not what you can see once inside. See the permissions matrix.
- Not something an administrator sets up on your behalf. Each person enrols their own methods from their own profile, because the codes have to reach a device only they hold.