Turning on two-step verification

Two-step verification asks for a six-digit code from your phone as well as your password. It is the single most useful thing you can do to an account, because it means a stolen password on its own is not enough.

Cordice supports an authenticator app — any of them, they all follow the same standard — together with a set of recovery codes for when the phone is not available.

Generate the recovery codes first

Do this before you turn on the authenticator, not after. Recovery codes are the way back in when the phone is lost, broken or wiped; setting up the second step without them means one dropped phone locks you out permanently.

In a browser or the desktop app

1. Open Settings, then My Account.
2. Expand Recovery Codes and choose Generate Recovery Codes.
3. Save them somewhere that is not the phone you are about to rely on — a password manager, or printed and put away.

On Android, the same thing lives under Settings → Login & Security → Two-Factor Authentication.

Each code works once. You can come back to View Recovery Codes to see the ones still unused, or Reset Recovery Codes to void the whole set and issue a fresh one — do that if you think anyone else has seen them.

Then the authenticator app

1. In the same place, expand Authenticator App and choose Enable Authenticator.
2. Add the secret you are shown to your authenticator app, by scanning it or typing it in.
3. Enter the six-digit code the app gives you to confirm the pairing.

From then on, signing in on a new device asks for that code after your password.

To turn it off, use Remove Authenticator in the same place. You will be asked to prove it is you first, which is the point.

If you lose the phone

Use a recovery code in place of the six-digit one when you sign in. Then, once you are back in, generate a new set and pair the authenticator on the new phone — the codes you used are spent, and the old pairing is still valid on a device you no longer control.

If both the phone and the codes are gone, email support from the address on the account. Expect it to be slow and to involve questions: an account recovery that is easy for you is equally easy for somebody pretending to be you.