A password alone can be guessed, phished or reused. A second factor makes a stolen password useless. Hermetry supports passkeys and one-time codes, can require a second factor for every member, and asks for it again before some high-impact actions. This page explains each part.
Second factors
| Factor | How it works | Strength |
|---|---|---|
| Passkey | A fingerprint, face, device PIN or hardware security key. Phishing-resistant: it only works on Hermetry’s real address. | Highest. A passkey sign-in counts as a completed second factor on its own. |
| Authenticator app | A time-based code (TOTP) from an app on your phone, with backup codes. | High. |
| Email / SMS | A one-time code sent to your address or phone. | Lower: mail accounts and phone numbers can be taken over. |
At sign-in, an account with a code factor gets the Two-step verification step: choose the Verification method (Authenticator app, Email or SMS), select Send code where needed, enter the Code and Verify.
| Message | Meaning |
|---|---|
| “That code did not work. Try again.” / “That code is not correct. Check it and try again.” | Wrong code. |
| “This code has expired. Send a new one.” | E-mail and SMS codes are short-lived. |
| “Too many wrong codes. Please wait a few minutes and try again.” | The factor is blocked for a while after repeated wrong codes. |
| “This organization requires two-step verification. Sign in again and complete it.” | Your organisation requires a second factor and this session has none. |
In development: Setting up an authenticator app, e-mail codes or SMS codes from My Profile is in development. Today every member can add a passkey themselves; use it as your second factor.
Passkeys
Add a passkey
- Open My Profile > Passkeys (“Biometric or hardware key authentication”).
- Select Add Passkey and follow your browser’s steps.
- Give it a name, for example “work laptop” (Rename, 1 to 64 characters).
Each person can register up to 10 passkeys. The authenticator must confirm it is you with a PIN, fingerprint or face; one that cannot is refused: “This authenticator cannot confirm it is you with a PIN, fingerprint or face, so it cannot be registered.”
Add a backup passkey
With only one passkey the page warns Add a backup passkey: “You have one passkey. If you lose that device you could be locked out — register a second passkey on another device or a hardware key.” Select Add backup passkey.
Sign in with a passkey
On the sign-in page select Sign in with a passkey. You can sign in without typing a password or even your e-mail, when your passkey is stored on the device. The page says “Signed in with a passkey”.
The list shows when each passkey was Added and Last used. Remove deletes one: “You won’t be able to use it to sign in.”
Require two-step verification for everyone
An Owner can require a second factor for every member:
- Make sure your own account has a second factor and that you signed in with it. Otherwise the page says: “Set up a second factor for your own account first (an authenticator app or a passkey, on your account page), then sign in with it. Requiring it for everyone without one would lock you out.”
- Open Settings > Sign-in Policy: “Who may open this workspace: two-step verification for every member, and the IP addresses allowed or blocked”.
- Turn on Require two-step verification for every member and confirm Require it: “From now on every member must complete a second factor at sign-in. Members who have none set up cannot open this workspace until they add one.”
From then on every request must come from a session that completed a second factor. Members without one can still sign in, add a passkey on My Profile, and sign in again with it.
Tell your members before you switch it on.
Confirming high-impact actions (step-up)
Some actions ask you to prove it is you again, even in a session that already used a second factor: Confirm it is you — “This action needs a second factor. The confirmation is valid for this one action for five minutes.” Choose Confirm with a passkey or enter the Code from your authenticator app. “Backup codes cannot confirm an action.”
If you have neither: “No confirmation method is available. Set up a passkey or an authenticator app in your security settings.”
Hermetry’s operators can also require a step-up on a session that looks suspicious: the session stays signed in, but nothing works until the second factor is confirmed again.
Backup codes
When an authenticator app is set up, Hermetry gives four backup codes of the form 1234-5678. Each works once, at sign-in, in place of an app code. Store them offline. They cannot confirm high-impact actions.
Lost a factor
- Use another passkey or a backup code.
- If you have none left, ask your organisation’s owner to contact Hermetry support. Resetting a person’s two-factor setup is done by Hermetry, and it is written to the audit log (
auth.two_factor_reset_by_admin).
Related
- Sessions, lockout and trusted devices
- Single sign-on
- Access policies: deny an action unless the session used a second factor or a passkey (
subject.acr)