WEBVTT

1
00:00:01.342 --> 00:00:06.089
A password can be guessed, or stolen. Two-factor sign-in adds a second step: a six

2
00:00:06.089 --> 00:00:10.952
digit code from an app on your phone. In this episode we see how that works for your

3
00:00:10.952 --> 00:00:14.831
staff, from the first sign-in to the day someone loses their phone.

4
00:00:16.779 --> 00:00:21.662
The code comes from an authenticator app, which makes a new code every thirty

5
00:00:21.662 --> 00:00:26.101
seconds. Without the phone, a stolen password is not enough to get in.

6
00:00:26.394 --> 00:00:31.167
You decide who must use it. In the store settings, your administrator lists the

7
00:00:31.167 --> 00:00:36.181
permissions that need two-factor. Here, voiding a sale is one of them. Anyone whose

8
00:00:36.181 --> 00:00:41.256
role includes a listed permission must set up two-factor before they can do anything

9
00:00:41.256 --> 00:00:41.559
else.

10
00:00:42.284 --> 00:00:47.494
Taylor is a manager, and the manager role can void sales. Taylor signs in with an

11
00:00:47.494 --> 00:00:50.516
email and a password, the way they always have.

12
00:00:51.438 --> 00:00:56.639
Instead of the dashboard, Taylor lands on the profile page. It says that their role

13
00:00:56.639 --> 00:01:01.715
requires two-factor sign-in, and offers a button to set it up. Until Taylor does,

14
00:01:01.715 --> 00:01:03.846
the back office does nothing else.

15
00:01:03.996 --> 00:01:06.281
Taylor taps Set up two-factor sign-in.

16
00:01:07.816 --> 00:01:12.752
The page shows a QR code. Taylor opens an authenticator app on the phone, and scans

17
00:01:12.752 --> 00:01:17.629
it. If scanning is not possible, the app can also be given the key that is printed

18
00:01:17.629 --> 00:01:19.295
underneath, by typing it in.

19
00:01:20.472 --> 00:01:25.827
The app now shows a six digit code for this store. Taylor types it into the Code

20
00:01:25.827 --> 00:01:27.300
box, and taps Turn on.

21
00:01:28.073 --> 00:01:33.249
Two-factor is now on. The page shows ten recovery codes, once only. Each one works

22
00:01:33.249 --> 00:01:36.026
one time, in place of the code from the app.

23
00:01:37.539 --> 00:01:42.609
If the phone is lost, broken, or replaced, a recovery code is the way back in.

24
00:01:42.609 --> 00:01:47.939
Taylor should save them somewhere safe, such as a password manager, or print them.

25
00:01:47.939 --> 00:01:49.759
Then tap, I have saved them.

26
00:01:50.615 --> 00:01:54.564
The codes are gone from the screen, and the profile page is ready.

27
00:01:55.667 --> 00:02:01.287
From now on, signing in has two steps. Taylor signs out, and signs in again with the

28
00:02:01.287 --> 00:02:02.826
email and the password.

29
00:02:03.639 --> 00:02:09.233
Now the back office asks for a code. A wrong code is refused, and the person stays

30
00:02:09.233 --> 00:02:14.895
on this step. And a code can be used only once, so Taylor waits for the app to make

31
00:02:14.895 --> 00:02:15.578
a new one.

32
00:02:15.792 --> 00:02:20.673
Taylor types the current code from the app, and taps Verify. Taylor is in.

33
00:02:21.939 --> 00:02:26.034
Now suppose that the phone is gone. Taylor signs in with the password again.

34
00:02:27.562 --> 00:02:31.825
At the code step, Taylor types one of the recovery codes instead of the code from

35
00:02:31.825 --> 00:02:32.246
the app.

36
00:02:33.704 --> 00:02:38.259
It works, once. That recovery code is used up, and nine remain. The use of a

37
00:02:38.259 --> 00:02:42.814
recovery code is recorded in the audit journal. Taylor should now set up the

38
00:02:42.814 --> 00:02:44.912
authenticator app on the new phone.

39
00:02:46.669 --> 00:02:51.864
The profile page has a Turn off button. But while Taylor's role requires two-factor,

40
00:02:51.864 --> 00:02:56.688
the system refuses it. Only when the administrator removes the requirement can

41
00:02:56.688 --> 00:02:58.358
Taylor turn two-factor off.

42
00:02:59.243 --> 00:03:04.332
That is two-factor sign-in. In the next episode, we move to the register, and look

43
00:03:04.332 --> 00:03:07.124
at PINs, locking the register, and approvals.