Passwords leak. On a platform that can send millions of messages and move credit between accounts, that is not a small problem. Google Authenticator 2FA adds a 6 digit code on top of the password, and it costs you nothing to switch on.<\/p>\n\n\n\n
Do your own team before you do your customers.<\/p>\n\n\n\n
That is it. From then on, that admin needs the password plus the code.<\/p>\n\n\n\n
Every admin account should have this on. Admin accounts can change routing, move credit and see client traffic, so a leaked admin password is the worst case on your platform.<\/p>\n\n\n\n
The user then sees a 2FA<\/strong> tab on the Security page of their panel, where they scan the QR code, enter the 6 digit code and verify.<\/p>\n\n\n\n If you want it mandatory rather than optional:<\/p>\n\n\n\n Users who have not set 2FA up get redirected until they finish the setup. Tell your customers before you flip this, otherwise your support queue fills up the same morning.<\/p>\n\n\n\n Plenty of client accounts are shared by a team, which 2FA normally breaks. The practical workaround is for the user to save the QR code image when they set it up, so colleagues can scan the same code. Better still, give each person their own sub user, but that is a conversation, not a setting.<\/p>\n\n\n\n Users cannot remove their own 2FA, which is the point. They raise it with you, and you do it:<\/p>\n\n\n\n They do not need to log out. The next page they open redirects them to the 2FA tab to set it up again.<\/p>\n\n\n\n Verify who you are talking to before you reset 2FA. A phone call from “the client” asking you to remove their second factor is exactly what an attacker would do.<\/p>\n\n\n\n Turn on app based two factor login for your admin team and your customers, force it where you need to, and reset it when someone loses their phone.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[391],"tags":[409,410,411,407,408],"class_list":["post-1016","post","type-post","status-publish","format-standard","hentry","category-security-access-control","tag-2fa","tag-admin-security","tag-force-2fa","tag-google-authenticator","tag-otp-login"],"_links":{"self":[{"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/posts\/1016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/comments?post=1016"}],"version-history":[{"count":0,"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/posts\/1016\/revisions"}],"wp:attachment":[{"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/media?parent=1016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/categories?post=1016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smppcenter.com\/kb\/wp-json\/wp\/v2\/tags?post=1016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Forcing everyone to use it<\/h3>\n\n\n\n
\n
Shared logins<\/h3>\n\n\n\n
When someone loses their phone<\/h3>\n\n\n\n
\n
Related articles<\/h3>\n\n\n\n
\n