Two-step verification

What you get: that having your password is not enough to log in to your account. And by the way, don’t be left out on the day it becomes mandatory.

Before starting

It will be mandatory. The panel is warning you with a countdown: “It will be mandatory within 14 days”. When the deadline is up, the next time you enter you will have to activate it or else. Doing it now, calmly, is much better than doing it in a hurry from your mobile phone in the middle of an emergency.

You need an authentication application on your mobile phone. Google Authenticator, Authy, 1Password or Microsoft Authenticator are valid.

Steps

Account → Two-step verification menu.
Give the device a name - “my mobile” - and press Turn on verification.
Scan the QR code with the mobile app.
Write down the 6-digit code that the application shows you.
Save the backup codes. There are ten, 8 characters each. Each one is used once.

Backup codes are what save the day when you lose your mobile phone. Keep them somewhere other than on the same mobile phone: printed, in a password manager or on paper in a drawer.

How to check it worked

Don’t trust the screen to say “activated”. Log out and log back in: it will have to ask you for the code. That’s the only proof that matters, and it’s time to discover a problem, not tomorrow.

Take advantage and add a second device if you have another mobile phone or tablet. You can have several, and it is the most comfortable way not to depend on a single device.

Common problems

“Wrong code” and I’m copying it correctly: It’s almost always time for the mobile phone. The code is calculated with the clock: if the one on the phone is out of sync, it doesn’t match. Set the automatic time on the mobile phone and try again.
The code changes while I write it: Change every 30 seconds. If you catch it at the end, wait for the next one and write it down completely.
«Too many failed verification attempts»: After several consecutive failures, you have to start entering from the beginning. Go back to the login screen, enter your password and try again with a new code.
I have lost my cell phone: Use one of your backup codes, the 8-character ones, on the same site where the 6-character one is. Then log in, remove the lost device and register the new one.
I have lost my cell phone and the backup codes: Write to us by email address of your account. We will have to verify that it is you before we remove it, and that takes time: it is exactly what prevents someone else from requesting it on your behalf.
I want to take it off: You can do it from the same screen, but you need a valid code from one of your devices. Please note the deadline: when it becomes mandatory, you will be asked for it again when you enter.
I have run out of backup codes: Generate some new ones from the verification screen in two steps. The previous ones no longer valid as soon as you generate the new ones.
I use the API and now it won’t let me take the witness: It’s on purpose: the API witness requests the second factor just like the web, and when it is renewed it is checked again. A witness taken out before no longer lasts forever.