Securing your Nautilus account

This page is about your own sign-in to the Nautilus dashboard at app.vernesoft.com. Two-factor authentication for the end users of your application is a different feature, with its own switch and its own API: see Two-Factor Authentication (TOTP).

Your account is protected by your password. You can add a second step: a 6-digit code from an authenticator app (Google Authenticator, 1Password, Authy and any other app that supports TOTP). It is optional. An account that does not turn it on signs in with its password, as before.

Turn it on

  1. In the dashboard, open Profile Settings and then the Security tab.
  2. Choose Set up two-factor authentication, scan the QR code with your authenticator app (or type the key into it by hand), and enter the 6-digit code the app shows.
  3. Save the backup codes that appear next to it. Each one lets you sign in once if you lose your phone. They are shown only at that moment, so download or copy them and keep them somewhere safe, then confirm that you have saved them. The new codes only work after you confirm.

From then on, signing in asks for your password and then for a code. On the code screen you can choose Use a backup code instead.

Backup codes

On the same Security tab you can generate a new set at any time. The new set replaces the old one once you confirm it.

Turn it off

On the Security tab, choose Turn off two-factor authentication. Your authenticator and your backup codes stop working together, and your account is protected by the password alone.

If you lose your phone and your backup codes

Write to support from the email address of the account. We can remove the second factor from your account. When we do, you receive an email saying so, every session of the account is signed out, and the action is recorded in the account's audit log. You can then sign in with your password and set up a second factor again.

Changing your password

Changing your password through the recovery link also asks for the second factor first, if you have turned it on: the link proves that you own the mailbox, and the code proves that you hold the authenticator.