Two-factor authentication

A six-digit code from an app on your phone, on top of your password. It is the difference between a leaked password costing you an afternoon and costing you the account.

It is available on every plan, including while a subscription is lapsed. It is not something you pay extra for.

Turning it on

Profile → Security → Turn on two-factor.

1. Confirm your password. A signed-in tab is not proof that you are the one at the keyboard, so Sekee asks again at the moment of the change.
2. Scan the QR code with an authenticator app. Google Authenticator, 1Password, Authy and Microsoft Authenticator all work — there is nothing to install from us, and no phone number is involved. If you cannot scan it, open Can't scan it? and type the key in by hand.
3. Enter the six digits the app shows. Nothing is switched on until that code checks out, so an enrolment you abandon halfway leaves your account exactly as it was.
4. Save your backup codes. See below — this is the step people skip and regret.

Turning it on signs out your other devices

Deliberately. If the reason you are enrolling is that you think somebody knows your password, their session would otherwise stay valid for another 24 hours, and the second factor you just added would protect nothing until tomorrow.

The device you turned it on from stays signed in. Everything else has to sign in again — with a code, this time.

Backup codes

You get ten, once, when you turn two-factor on. Each one works a single time.

They are shown once and cannot be retrieved. Sekee stores only a fingerprint of each code, not the code, so there is no screen anywhere — and nobody at Sekee — that can read them back to you. If you lose them, you generate a new set, which replaces the old one.

The dialog will not close until you tick the box saying you have saved them. That is not a dark pattern; it is the one screen in the product whose contents are unrecoverable, and closing it by reflex is how people end up locked out months later.

Keep them somewhere you can reach without your phone — a password manager, or printed and put away. A file in the Downloads folder of the laptop you carry next to the phone is not a backup.

Profile → Security shows how many you have left. When it gets to two, generate a new set.

Signing in

After your password, Sekee asks for the code. Enter it and you are in.

Your password alone gets you nothing at that screen — not a session, not your name, not your organization. The half-finished sign-in expires after five minutes, and closing the tab discards it.

Lost your device

The link is on the code screen.

1. Use a backup code. Enter one instead of the six digits. It signs you in and it is then spent. Go to Profile → Security and set up your authenticator again on the new device.
2. Out of codes as well? Ask an owner or admin to reset your two-factor from Administration → Members. You are signed out everywhere, your old codes stop working, and you set up a new app the next time you sign in. Who can do this depends on your own role — see Resetting somebody's two-factor: an admin can reset it for a member or a viewer, but if you are an admin yourself only the owner can, and the owner's own two-factor cannot be reset this way at all.

:::note There is no "email me a code" This is a deliberate omission, not a missing feature. An emailed code would make your inbox the second factor — and your inbox is already what can reset your password. Anyone holding a leaked password could then walk straight past the authenticator, which is the exact attack two-factor exists to stop. :::

Changing or turning it off

Profile → Security offers Generate new backup codes and Turn off.

Both ask for your password and a current code. Both, not either: a code alone means an unlocked laptop with the phone beside it removes the protection, and a password alone means the leaked password does. Either one on its own would undo the point of having a second factor.

To move to a new phone, turn two-factor off and set it up again. Generating new backup codes invalidates every code from the previous set.

If your organization requires two-factor, you cannot turn it off — see below.

Sign out everywhere else

Profile → Security → Sign out everywhere else ends every session your account has except the one you are using. Worth doing after signing in on a machine that is not yours.

It asks for your password, and your code where you have one, because a stolen session must not be able to lock you out of your own account.

Sekee cannot list your devices individually, and does not pretend to. Sessions are stateless, so there is a single cut-off and everything older than it stops working at once — all or nothing is the honest offer.

Note that changing your password does not do this, but a password reset from the sign-in screen does.

When your organization requires it

An owner or admin can require two-factor for everyone. See Policies.

• Before the deadline, you get a banner at the top of every screen naming the exact date.
• On the deadline, you are signed out. Signing in again takes you straight to the setup screen, and finishes the sign-in once you have completed it.
• While the requirement stands, you cannot turn two-factor off.

Viewers are not affected.

Emails you will get

Sent whatever your notification preferences say, because these are the only warning an account takeover produces:

• Two-factor turned on, or turned off
• New backup codes generated
• A backup code used to sign in
• An owner or admin reset your two-factor
• You signed out your other devices

If one of these arrives and it was not you, change your password immediately and tell your organization owner.

What is recorded

Every change to a second factor is written to the activity log, as is every failed code — the rows somebody reads when asking whether an account was attacked. A successful code is not recorded: it would happen every day and bury the rows that matter.

Those rows are readable on the Business plan, along with the rest of the security and administration categories. They are written on Standard too, so moving up later surfaces the history already collected rather than starting from zero.