A password can be stolen in many ways: phishing, a leak from another site where you used the same password, or a keylogger on someone else's computer. Two-factor authentication (2FA) means the password alone isn't enough to get into your account.
Who can turn it on
Everyone turns on 2FA for their own login: the owner and managers in Settings → Security, employees in the app under Profile. On a phone there is no QR code to scan: tap the button that adds the account to the authenticator app on that phone, or copy the key.
How it works
Once it's on, logging in takes two steps:
- email and password, as usual,
- a 6-digit code from an app on your phone. The code changes every 30 seconds.
On your own computer or phone you can tick Trust this device for 30 days. Mopka then won't ask for a code there for 30 days.
What you need
An app for one-time codes (TOTP), e.g. Google Authenticator, Microsoft Authenticator or Authy, or a password manager with this feature, such as 1Password or Bitwarden. One is enough.
Turning it on step by step
- Go to Settings → Security, to the Two-factor authentication (2FA) section.
- Click Enable 2FA.
- Mopka shows a QR code and a text key.
- In the app on your phone, add an account and scan the QR code or type in the key.
- Enter the current code from the app in Mopka and confirm.
Finally you get 10 backup codes. Each works once. Save them somewhere safe or download them with Download codes, because once you close the window you won't see them again.
Trusted devices
Only tick Trust this device for 30 days on your own hardware, never on a public or shared computer.
Mopka has no list of trusted devices. All of them lose their trusted status when you change or reset your password or turn off 2FA. If you suspect someone has access to your device, change your password.
Lost phone
1. A backup code. On the login screen click Use a backup code and enter one of your codes. Once logged in, turn off 2FA with Disable 2FA, entering your password and another backup code, then turn it on again with your new phone.
2. A trusted device. If you ticked Trust this device for 30 days on your laptop earlier, log in from there and do the same.
3. Contact us. If none of that works, email [email protected] from the address the account is registered to. Once we've confirmed it's you, we'll turn off 2FA.
New backup codes
When you're running out of codes, click Generate new backup codes. The old codes stop working.
Turning off 2FA
In Settings → Security click Disable 2FA and enter your password and a code from the app or a backup code. Mopka emails you that 2FA has been turned off. If it wasn't you, change your password straight away.