Who can do this?
Every signed-in person can turn on two-factor for their own account. For accounts with user management it is mandatory: these accounts cannot turn it off.
Two-factor authentication
With two-factor, signing in also requires a code from your authenticator app.
What is it for?
A password alone can be watched, guessed or stolen. Two-factor authentication adds a second hurdle: after the password, Illumentis asks for a six-digit code that only your authenticator app on your device generates.
It is like a safe with a key and a combination lock. Whoever knows only one of them cannot get in. You link the app once with a QR code and confirm the first code. Only then does two-factor apply.
For the setup you only need an authenticator app on your smartphone or on another device that you carry with you.
You also receive backup codes. They replace the app code when your device is missing. Illumentis shows them to you only once, so save them right away in a safe place.
How it works
-
In the account settings, under “Account & Security”, open the “Two-factor authentication” section and choose “Enable”.
What you see afterwards: A QR code appears, with a key below it.
-
Scan the QR code with an authenticator app such as Google Authenticator or Authy. If your app cannot read a QR code, enter the key by hand.
What you see afterwards: The app shows a six-digit code.
-
Enter the code in the “Confirmation code from the app” field and choose “Confirm and activate”.
What you see afterwards: Illumentis shows you ten backup codes.
-
Save the backup codes in a safe place and choose “I’ve saved the codes”.
What you see afterwards: The section shows “Two-factor authentication is active.” and the number of remaining backup codes.
Your data
Illumentis stores the backup codes only as hashes, not in plain text. That is why it shows them to you only once and not again.
Limits
You get ten backup codes, and each one is valid only once. Two-factor only takes effect after the first code is confirmed. When you turn it off, Illumentis asks for your password or a current code. The code is rate-limited to 5 attempts in 5 minutes.
Frequently asked questions
What do I do if I lose my device?
Enter a backup code instead of the app code when you sign in. If the backup codes are missing too, recovery with the recovery key or a request to an admin helps. Your manuscripts are unaffected.
How can I tell how many backup codes are left?
With two-factor turned on, the section shows “{count} backup codes remaining.”. If only a few are left, turn two-factor off and on again: the setup generates ten new codes.
Can I turn two-factor off again?
Yes, with “Disable”, after you have confirmed your password or a current code. Accounts with user management cannot turn it off.