Multi-factor authentication

A step of the Cloud application tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Add a second factor with recovery codes, set up and turned off in settings. A hosted provider does most of this for you.

Usually comes after: Settings page.

Prompt for your AI assistant

Read the sign-in decision record in docs/decisions. Add multi-factor authentication. On a hosted provider, turn it on and start enrolment from settings. For own passwords, use TOTP through a maintained library with the secret encrypted at rest, one-time recovery codes stored only as hashes and throttled attempts, asked for at sign-in after the password. Ask for a fresh sign-in to turn it off and email the account when it is turned on or off. Write in docs/runbooks how someone who lost both the device and the codes gets back in.

This is https://gradus.kazet.blog/tree/cloud-application/step/multi-factor-auth as plain HTML. In a browser the page also lets you mark the step forged and copy a message for your AI assistant.