Two-factor Authentication
Two-factor authentication (2FA) adds a second challenge when you sign in using your password — usually a rotating six-digit code from an authenticator app on your phone. Even if someone learns your password, they can't sign in without also having your phone.
What it protects
- Your sign-in. Someone who steals or guesses your password still can't get past the second step.
What it does not protect
- It does not add another layer on top of Trove encryption. Your Trove content is protected by your Trove Unlock Password (if enabled) or your login password, plus your recovery codes. 2FA does not change that.
When to use it
- Always, if you can. It's a large security improvement for a small daily inconvenience.
- Especially if you sign in from multiple locations or devices.
Tradeoffs
- Losing your authenticator device makes sign-in harder — set aside the Identity recovery codes that 2FA offers when you enable it.
- NOTE: that 2FA recovery codes are separate from the Trove recovery codes used to recover a forgotten password. They solve different problems. Neither set replaces or works with the other.
- Logging in using a Passkey skips the 2FA challenge. We regard a Passkey as a kind of second "factor" since they only work on devices where Passkeys are registered.