Step 1: trust.
Yes, it is.
But there’s a good chance that it’s not needed.
Using a specific type of two-factor authentication, you can set up both your phones as allowed two-factor devices for the same account.
Sharing 2FA
You can share two-factor authorization by using an authenticator app that supports TOTP codes. Set it up once; then scan the same QR code on both phones. Or use a shared password manager like 1Password that includes the code. That way, either person can log in without extra hassle.
TOTP two-factor authorization
TOTP stands for Time-based One Time Password, which I often refer to as Google Authenticator-compatible two-factor authentication, or just authenticator-based. Once configured, your device (typically an app on your smartphone) displays a six-digit code that changes every 30 seconds. Your ability to present this code correctly when requested acts as your second factor.
Unlike other forms of two-factor authentication, we can set up TOTP on more than one device.
If you don’t have a smartphone or a TOTP app you can use elsewhere, or the service you’re using doesn’t offer TOTP authenticator as a second factor, then this option isn’t available to you.
But if it is, we can remove this annoyance for you.
Help make it permanent by becoming a Patron.
Related
Why ANY Two-Factor Is Better than No Two-Factor
Headlines are proclaiming that two-factor authentication has been hacked. That in no way means you shouldn't use it. Your account is still much safer with two-factor enabled.#70786
Setting up two two-factor devices manually
The process is pretty straightforward.
- Sign in to the account you want to share with someone else.
- Begin the process of setting up authenticator-based 2FA.
- Take a screenshot of the QR code (or copy the text code). Save it somewhere safe.
- Use that QR code to set up the authenticator on one device.
- Use that QR code a second time to set up the authenticator on the second device.
Both devices should now show the same changing six-digit number associated with this account.
Either device should now act as an accepted 2FA for that account.
That QR code contains all the magic. By saving it, you can set up multiple 2FA devices for the same account at any time. Should you ever lose your device, it’s also a great way to set up 2FA on a replacement without needing to turn 2FA off and back on again on the account.
Save the QR code in a secure place in case you need it later. Maybe store it offline, in an encrypted vault, or somewhere else that’s accessible only to you.
Related
How to Add Two-Factor Authentication to Your Google Account
Adding the most common and secure form of two-factor authentication to your account.#175329
Setting up two two-factor devices automatically
Some password managers can also serve as your second-factor authenticator. When you do this, then:
- Any device on which you are signed in to your password manager can act as your second factor. For example, both your PC and your phone.
- If your password manager can share items or collections with another user of the same password manager, then accounts with two-factor authentication can also be shared, including the second factor.
I do both using 1Password.
For example, my wife and I share an online shopping account that has two-factor authentication enabled. The information is stored in 1Password.
- When needed, I can use any of my PCs or my mobile phone to provide the second factor code.
- Since that item is shared between my wife’s 1Password account and my own, either of us can provide the code.
It’s probably the most convenient way to manage two-factor on a shared account.
Sometimes you can use a dedicated app
Some websites or services offer a dedicated app you can install on your smartphone. Sometimes it’s this app that can act as a second factor.
For example, when signing into a bank that has such an app:
- You sign in normally with a username and password.
- You’re asked which form of two-factor you would like to use (typically choosing between SMS, email, or the app).
- Choosing the app causes a notification to appear on the mobile device on which you’ve installed and previously used the app.
- Confirming the sign-in in the app acts as your second factor.
Sharing that second factor is as simple as installing the bank’s app on both of your phones and signing in at least once. The next time two-factor is required, both devices will get the notification, and either device can approve the sign-in.
Not all services offer this, but it’s another convenient approach when they do.
Do this
Enable two-factor authentication on accounts that support it. It’s one of the most important steps you can take to secure your account.
If you can, use authenticator-based two-factor authentication, saving the QR code (or text code) as you set it up. You can then share that code with anyone else you want to allow access to the account. If you’re both using a password manager that supports TOTP two-factor, even better: the two-factor capability will be included with what you share with someone else.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Two-factor authorization can be a pain when using an account that is not yours. And sometimes when it is yours.
My Church has a Zoom account that they pay for, that I need access to. But to sign in, the two-factor authorization is sent to the Church Email account which I don’t have access to normally, and the Email account’s two-factor authorization goes to the Secretaries phone number.
So if I want to sign in, I have to call her to watch the email and tell me the code, so I can get into Zoom.
The workaround of this is just never sign out of Zoom. But that leaves a security hole.
The pastor also uses this same account for Zoom meetings, as well as several other people.
I suspect this also happens in business. People are given access to a program, but as it is the companies, they are not given the access to the authorization process, which is often an email account or phone number. Then the account is just left open and accessed when needed.
We have this EXACT same issue at an organization I support. We have two solutions:
– the account email address we use is “zoom@ourorganization”, which is a distribution to all authorized zoom users. So everyone gets the emailed code.
– We also have google-style 2FA, which is stored in 1Password, which is shared among organization users. 2FA is an option instead of the emailed code.
Excellent article, and timely. I have someone else managing my website and I wanted to set up Two Factor security but could not because only one of us could generate the codes. With this article I will look into setting up shared Two Factor Authentication so I will have the security I want but we both will have access.
Thanks
Jim