What is multi-factor authentication?
Traditionally you have logged in with a username and password, maybe directly, maybe through a single sign-in portal. It's a tried and tested authentication system but it's weak. People pick bad passwords, enter them into the wrong places, write them down on paper, give them to the wrong people.
Credentials are something you know. Multi-factor authentication adds different types of factor, like something you have (a USB security token, your phone), or something you are (fingerprint, voice scan, location). For somebody to break in, they would need your credentials and the (eg) Security USB key you keep on your keychain. It dramatically decreases the threat of phishing and data breaches.
Where to start? Which factor should I add?
While there are hundreds of products compatible with this system, we support three main types of factor...
TOPT Authenticators
Free for anybody with a phone.
Install Google Authenticator or Authy from your phone's marketplace. Click the Add button above, and select TOTP Authenticator. Scan in the barcode in your Authenticator app. It will give you a 6-digit code to type back into this website. That's it, you're paired.
The code will rotate every 30 seconds. To authenticate later, you will be asked what the current code is.
FIDO2 Devices
A broad range of devices:
- Windows Hello fingerprint or facial recognition
- Google Chrome
- Google Android via biometrics or location
- FIDO2 USB and NFC keys
Windows Hello is convenient but can tie you to one computer. Physical keys are useful for mobile usage.
U2F/FIDO1 USB devices
The predacessor to FIDO2, these are usually USB devices that start blinking when you need to authenticate. Press the button and you're done.
These are cheap and convenient for desktop-only installations.
What are fallback factors?
They are secondary factors but they are usually weaker, more insecure and commonly more inconvenient than plugging in a USB key. They are however, a good defence from getting locked out when your primary factors aren't available.
When you request to authenticate with a secondary factor, we send a the same OTP to all your devices. If you get a message like this and didn't request it, it could mean your main account is compromised.
What happens if I lose my factor or don't have access to it when I need it?
Contact an administrator immediately. They can deactivate or remove your active factors, allowing you to add another.
We recommend you keep a backup secondary factor. Having a FIDO2 token is convenient (eg just leave your keys plugged in while you're at your computer) but having a TOPT authenticator will serve as a suitable backup if you misplace your keys. Additional factors can dilute over-all security.