Account security work, focused on two-factor authentication. If you use 2FA, there is one thing worth doing at the end.
Added
- Recovery codes for two-factor authentication. Ten single-use codes that sign you in if you lose your authenticator app. Available under Settings → Two-Factor Authentication.
- “No longer have access to that device?” on the sign-in code screen — enter a recovery code instead of your authenticator.
- Accounts that already had 2FA switched on are offered a set at their next sign-in.
Changed
- Recovery codes are shown once, when they are created. They are stored one-way, which means nobody can retrieve them later — not from the database, and not through support. If you lose the list, generate a new set from Settings.
- Generating a new set retires the old one, so a list you no longer trust can be replaced.
- Signing in with a recovery code now takes you straight to setting your authenticator up again. This is deliberate: until you do, the device you lost can still generate valid codes.
- Turning 2FA off in Settings now also accepts a recovery code, so a lost phone can be swapped for a new one without help.
Fixed
- 2FA setup now waits for the server to confirm before reporting success — an enrolment can no longer appear to work when it did not.
- Settings now correctly shows 2FA as enabled straight after setting it up from the sign-in prompt.
- Tightened the setup screen’s behaviour on accounts where 2FA is required.
Recommended
If you have 2FA enabled, take two minutes to generate your recovery codes and store them somewhere that is not your phone — a password manager, or printed and put away. They are only useful if they are somewhere you can reach when your phone is not.
John
FixlyDesk