Two-factor authentication

Two-factor authentication (2FA) adds a second step to signing in: after your password, Masto Control asks for a six-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in without that phone.

It is optional and set per account - turning it on for yourself does not change how your colleagues sign in.

Which app to use

Any app that follows the standard time-based one-time password scheme works, and they all read the same QR code:

• Google Authenticator (Android, iOS)
• Microsoft Authenticator (Android, iOS)
• Authy - also backs your codes up across devices
• 1Password, Bitwarden, Proton Pass - if you already keep passwords there, the code can live on the same item
• Aegis, FreeOTP and other open-source apps

If you already use one for another service, use that one. There is nothing Masto Control specific to install.

Turning it on

There are two places to do this, and they do the same thing - use whichever you are already in:

• In the app: the gear icon (or your avatar) → Profile → the Security tab, under Change password.
• In your account area on the website: sign in at mastocontrol.com/login and look for the card under your workspace.

Then, in either place:

1. Press Set up two-factor authentication.
2. Pick your app from the row of buttons - the line underneath tells you where its "scan a QR code" button is.
3. Scan the QR code with the app. If the phone cannot scan (a camera problem, or you are setting this up on the phone itself), type the key shown next to the code in by hand instead.
4. The app starts showing a six-digit code that changes every 30 seconds. Type the current one into Enter the 6-digit code the app shows and press Turn on.

The code proves the app really holds the secret, so nothing is switched on until you have entered one successfully. If it is refused, check that your phone's clock is set to update automatically - a clock that is minutes off produces codes Masto Control cannot match.

Save your recovery codes

The moment 2FA is on, you are shown ten recovery codes that look like bxa5c-zzyb6. Each one works exactly once, in place of a code from the app.

They are shown once and never again. Save them somewhere you can reach without your phone: a password manager, a note in a safe, a printout. If you lose both your phone and these codes, only support can get you back in.

Press Copy codes to put all ten on the clipboard, then I have saved them.

Signing in from then on

1. Enter your email and password as usual.
2. A second screen asks for the code. Open your authenticator app, read the current six digits, and press Continue.

If your phone is not to hand, choose Use a recovery code instead and enter one of the ten codes you saved. How many you have left is shown on the Two-factor authentication card, and you can issue a fresh set at any time.

The code is asked for once, on the way in - moving from the account area into the workspace does not ask again.

Turning it off, and new recovery codes

Both live on the same card, in the app or in your account area:

• Turn off asks for your password and a current code. Requiring both means someone who has taken over an open session still cannot strip the protection off your account.
• New recovery codes asks for a code and replaces all ten. The old ones stop working immediately - use this if you think your list has been seen, or if you are running low.

If you lose your phone

Use one of your recovery codes to sign in, then turn 2FA off and set it up again on the new phone.

If both the phone and the codes are gone, contact support from the email address on the account. Support can remove the second factor after confirming who you are - there is deliberately no automatic way around it, because an automatic one would be a way around 2FA itself.

note

Resetting your password does not remove 2FA. After a password reset you will still be asked for a code, which is what makes 2FA worth having: a stolen inbox is no longer enough to reach your workspace.