Two-factor authentication

Two-factor authentication adds a second step to signing in, after your password. It lives on the Security page, under the account menu, alongside changing your password.

The two methods

There are two ways to answer the second step, and you can turn on either or both.

An authenticator app — Google Authenticator, 1Password or anything similar — generates a fresh code every thirty seconds or so. This is the stronger option, and the one to prefer if you can. To set it up, press Set up on the Authenticator app card, scan the QR code (or enter the key by hand if scanning is not convenient), and confirm it with the code your app is showing and your current password.

An emailed code sends a one-time code to your account's email address each time you sign in. It is the weaker option: anyone who can read your inbox can also reset your password, so an emailed code protects you against less than an authenticator app does. It is offered because it needs no app, and because it is the only option that still works if your phone is the thing you have lost. This option only appears on the Security page when the instance you are using has been set up to send email at all — if you do not see an Email code card, that is why, and it is not a fault on your account.

Turning on your first factor, of either kind, is also when you get your recovery codes — see below.

Recovery codes

Recovery codes are shown to you exactly once, at the moment you turn on your first factor, and Rolehound cannot show them to you again after that. Save them somewhere that is not the phone your authenticator app is on — download them, copy them, or write them down, whatever you will still be able to reach if you lose that phone. Each code works once; using one crosses it off.

Running low is shown on the Recovery codes card. Generate new codes there replaces the whole set — do this with your current password, and treat the new codes exactly as you did the first: this is the only chance to see them.

Signing in once it is on

You sign in as usual, with your email address and password. Instead of landing in the app you are taken to a second screen headed Verify it's you, which asks for a code before any session is issued.

What it shows depends on which methods your account holds. If you set up an authenticator app, type in the code it is showing and press Verify. If your account also has an emailed code turned on, an Email me a code button is offered too — press it, wait for the email, and type in the code it contains.

A wrong or expired code is answered with Invalid code and the screen stays put — try again with whatever your app is currently showing, since these expire quickly. Do not keep guessing, though: repeated wrong codes lock the account for a while, exactly as repeated wrong passwords do. The screen tells you when that has happened, and no code is accepted until the lock has expired — waiting is the only thing that clears it. Attempts are rate limited on top of that, so you may be asked to wait a minute before you get that far.

Use a recovery code, under the field, switches the screen over to accept one of your recovery codes instead of a live code.

Back to sign in returns you to the sign-in screen without verifying — useful if you meant to sign in as somebody else.

Removing a factor, or turning it off entirely

Each factor's card on the Security page has its own remove action once that factor is on, and turning two-factor off altogether works the same way — all of them ask for your current password first. Turning a factor on asks for it too, so nobody who has only got hold of a signed-in browser can either weaken your account's protection or quietly add a second factor of their own.

If you cannot reach any factor

Lost your phone, and out of recovery codes, and no emailed code turned on (or no way to reach that inbox either) — that is a genuine lock-out, and there is nothing to press on the sign-in screen that gets you back in. Contact whoever runs this instance. They can reset two-factor on your account from the admin console; doing so is always recorded in the audit trail, and — if this instance is set up to send email — you are also sent an email telling you it happened, in case it was not you who asked. Once it is reset, you sign in with your password alone and can turn two-factor back on when you are ready.