Set up two-factor sign-in and test the way back in
Turn on two-factor sign-in for your Borago Board cloud account, save the recovery codes, add a recovery email and test signing in with each.
Two-factor sign-in protects your Borago Board cloud account with a code from an authenticator app on top of your password. No email is sent at sign-in. This tutorial turns it on, keeps two ways back in, and tests them while you still have your phone.
You will build
A cloud account that asks for an authenticator code at sign-in, with saved recovery codes and a confirmed recovery email.
You need
- A cloud account, signed in to the cloud board in a browser or on your phone. See Cloud sync, browser and phone.
- An authenticator app, such as Google Authenticator, 1Password or Authy.
- A second email address you can read, different from the one you sign in with.
Steps
1. Open your profile
On the cloud board, open the profile menu in the top bar and press Profile.
What happens. The profile page shows Two-factor authentication and Recovery email. Both are changed here, on the cloud board. The desktop app's profile shows whether two-factor is on but cannot change it.
2. Start the setup
Beside Two-factor authentication, press Set up. The dialog Set up two-factor authentication shows a QR code.
What happens. The account gets a new secret, stored encrypted, and two-factor stays off until you prove the app has it. If you cannot scan, the dialog prints the key under Can't scan? Enter this key manually.
3. Scan and confirm
Scan the QR code with your authenticator app. Type the 6-digit code it shows into Verification code and press Verify and enable.
What happens. Two-factor is now on. The dialog changes to Save your recovery codes and lists them.
4. Save the recovery codes
Press Copy or Download and keep the codes somewhere safe, away from your phone. Then press I have saved my recovery codes.
What happens. Each code signs you in once, in place of an authenticator code. They are shown only this once. The board keeps only a fingerprint of each code, so nobody can show them to you again.
5. Add a recovery email
Under Recovery email, press Add. Type the second address in Recovery email address and your password in Your password, then press Send confirmation code. Type the code that arrives at that address and press Confirm.
What happens. The address is saved only once you prove you can read it. If you type your sign-in address, the form suggests a different one, so losing one inbox does not also lose the way back.
6. Sign out and sign in with the app
Open the profile menu, press Log out, then sign in with your email and password.
What happens. The form asks for Authentication code. Type the current code from your authenticator app and press Verify. Each code works once, so a code seen over your shoulder cannot be used again.
7. Sign in once with a recovery code
Log out again and sign in. At Authentication code, type one of your saved recovery codes instead and press Verify.
What happens. You are in, and that code is used up. Signing in with it a second time is refused.
8. Read the lost-authenticator path, without using it
Log out and sign in to the code step once more. Under the code field is Can't access your authenticator?. Do not press it now. Press Back.
What happens. Pressing Can't access your authenticator? emails a code to your recovery address. Entering it shows Recovery scheduled. Two-factor is removed after 24 hours, never at once, and your primary email receives a notice with a cancel link at the moment the hold starts. Signing in with your authenticator or a recovery code during the wait cancels it too. When the hold ends, you sign in with your password alone and set up an authenticator again.
Check it worked
The profile shows Enabled under Two-factor authentication, and Recovery email names your second address.
If you lose everything
Without your phone, your recovery codes and your recovery email, use Forgot password? on the sign-in page, then Have an authenticator app? Reset without email, then Lost your authenticator too?, and press Request recovery. That starts a 24-hour hold from your primary email alone. When it ends, two-factor is removed and a password reset email is sent. While it waits, the cancel link in the email and the This was not me - cancel button on a banner in any cloud board session still signed in both stop it. A plain emailed password reset does not remove two-factor on its own.
Where to go next
To turn it off, press Disable beside Two-factor authentication and enter a current code or a recovery code.
Related: Accounts, Security, Cloud sync, browser and phone, Switching accounts on one machine