# Two-factor sign-in with an authenticator app

> Sign in with password and a code from an authenticator app, recovery codes and trusted computers for 30 days. Optional per user.

Source: https://1x1it.de/en/workorderagent/zwei-faktor/

The WorkOrderAgent holds invoices, customer data and bank details. With two-factor sign-in you need a code from your phone in addition to your password. On your own office computer you can skip the code for 30 days, so security does not get in the way day to day.

[Request a demo](https://1x1it.de/woa/demo-anfrage)
[All modules at a glance](https://1x1it.de/en/workorderagent/)

Two-factor Security

- **Method:** code from an authenticator app (TOTP)
- **Apps:** e.g. Google Authenticator, Microsoft Authenticator, 2FAS
- **Recovery:** recovery codes
- **Trusted computers:** default 30 days, adjustable

## Why a password alone is not enough

Passwords get guessed, stolen from other services or phished by fake emails. Without a second factor, anyone who knows your password would have full access to your accounts.

With two-factor sign-in an attacker lacks the decisive piece: the six-digit code that only the app on your phone generates and that changes every few seconds.

## Everything on one page

Set up, renew recovery codes, manage trusted computers: each user manages their two-factor sign-in themselves, clearly on one page.

Sample data Click to enlarge.

## Set up in a few minutes

All you need is your phone and an authenticator app.

- Enable: The administrator offers two-factor sign-in for the server. From then on each user can turn it on for themselves.
- Connect the app: You scan the code shown with an authenticator app such as Google Authenticator, Microsoft Authenticator or 2FAS.
- Keep recovery codes: At the end you receive recovery codes. Keep them safe; they help if your phone is ever missing.
- Trust the computer: On your office computer, tick a box at sign-in. For the set period the password is enough there.

## Secure in detail

- **Password always required:** The password is requested even on trusted computers. Only the code is skipped.
- **No plain text on the server:** For trusted computers the server stores only a check value. The cookie cannot be read by scripts and is only sent encrypted.
- **Revoke trust:** Trusted computers can be revoked individually. Turning two-factor sign-in off revokes all of them at once.
- **In the webmailer too:** The administrator can also offer two-factor sign-in for the webmailer.

## Frequently asked questions

### Is two-factor sign-in mandatory?

No. The administrator offers it for the server, and each user turns it on for themselves.

### Does the code come by email or SMS?

No, the code comes from an authenticator app on your phone. That is more secure than codes by email or SMS.

### How long does “trust this computer” last?

By default 30 days. The administrator can change the period for the server or switch the feature off with 0 days.

### What if I lose my phone?

Sign in with one of your recovery codes and set the app up on your new phone.

## Related

[Control centre A server just for your business](https://1x1it.de/en/workorderagent/schaltzentrale/)
[Banking security Approval via banking app](https://1x1it.de/en/workorderagent/banking/sicherheit/)
[Webmailer Email in the browser](https://1x1it.de/en/workorderagent/mailserver/webmailer/)
[Security alerts Current BSI warnings](https://1x1it.de/en/it-support/sicherheitshinweise/)

## Better protection for your business?

Request a free demo and see two-factor sign-in in the WorkOrderAgent.

[0173 644 22 17](tel:+491736442217)

[Request a demo](https://1x1it.de/woa/demo-anfrage)