Enabling Two-Factor Authentication (2FA)
Two-factor authentication (2FA) adds a 6-digit code from an app on your phone every time you sign in. Even if your password leaks, nobody else can sign in without your phone.
2FA and session management ship with this release. It is optional: accounts without 2FA sign in exactly as before. A shop can also require 2FA for its owner accounts.
Who can use it
2FA applies to owner accounts (the accounts that sign in to the web Dashboard and the mobile app). Staff logins (PIN or password) and customer accounts are unchanged. Only the owner can open the Security page.
Authenticator apps that work
Etalasse uses the common standard (RFC 6238: 6 digits, a new code every 30 seconds), so these apps work:
- Google Authenticator
- Authy
- 1Password
- Microsoft Authenticator
Other apps that support standard TOTP codes generally work too.
Steps to enable
Open Settings > Security, and on the Two-factor authentication card choose Enable.
- Install an authenticator app on your phone if you do not have one.
- Etalasse shows a QR code and a manual key. In the app, add an account and scan the QR. If you cannot scan, choose manual entry and type the manual key (shown in groups, with a copy button).
- Enter the 6-digit code shown in the app.
- If you want, tick Sign out my other devices to immediately sign out every other device that is signed in. See Active Sessions.
- Etalasse shows 10 recovery codes. Download (.txt), copy, or print them, then tick I saved these and press Done.
The manual key is shown only in step 2 and cannot be viewed again. The same goes for the 10 recovery codes: once you close that screen they cannot be shown again. If you leave the setup open for more than 30 minutes before entering the code, it expires and you must start again from step 1 (starting over replaces the old, not-yet-active key).
Etalasse sends an email notifying you that 2FA was enabled. The email never contains codes.
Recovery codes
Recovery codes are your way out if you lose your phone. The rules:
| Topic | Rule |
|---|---|
| Count | 10 codes, each single use |
| Storage | Keep them somewhere safe separate from your phone, such as a password manager or a printout stored securely |
| Typing | Upper or lower case, with or without dashes or spaces |
| Remaining | The Security page shows how many are left; you are warned when fewer than 3 remain |
Generating new recovery codes
In Settings > Security, choose Regenerate recovery codes and enter a code from the app (or one recovery code). You get 10 new codes and all the old codes stop working immediately. Store the new ones the same way. Etalasse sends a notification email.
Disabling 2FA
In Settings > Security, choose Disable and enter your password and a code (app code or recovery code). If the shop requires 2FA, you will be asked to enable it again by the deadline. Etalasse sends a notification email.
Clock tolerance
Codes are computed from your phone's clock. Etalasse accepts the current 30-second window plus one window before and after. If codes keep being rejected, make sure your phone's clock is set to automatic (network time).
Tips
- Enable 2FA before you need it, and save the recovery codes right away.
- When changing phones, move the authenticator account first or, if your app cannot export, disable 2FA and enable it again on the new phone.
- Never share the 6-digit code or a recovery code, including with anyone claiming to be from Etalasse.