Two-step verification and passkeys for teams

This guide is for team owners and administrators who want to make sign-in safer. It explains two-step verification with an authenticator app and passkeys, what each protects against, and how to roll them out across a team without a support queue.

If you could do one thing to make your team’s accounts safer this week, it would be to make sure nobody signs in with only a password. Passwords get reused, guessed, phished and leaked. A second step means that a stolen password is not enough by itself. This post explains the options in Nubo Suite, what each is good for, and how to roll them out across a team without hurting productivity.

Descriptions of Nubo behaviour below match our current account documentation; the in-app settings are the final word.

What each option does

Password. The starting point. Nubo asks for at least 10 characters, rejects passwords on a list of very common ones, and rejects passwords that contain your username or email name or follow trivial sequences. An optional check against a breached-password service can be switched on; only a short prefix of a hash leaves our servers when it is used.

Authenticator app (TOTP). After the password, you enter a six-digit code from an app on your phone, which changes every 30 seconds. The code is generated from a secret shared once when you set it up. Codes cannot be reused. This protects against someone who has your password but not your phone.

Backup codes. When you enable the authenticator, you receive ten single-use backup codes. Each works once. They are for the day you lose your phone. Print them or store them in a password manager, not in the same place as your password.

Emailed code (optional). You can choose to receive a code by email as a second step. It is easier than an app, but only as strong as the mailbox that receives it, so we treat it as a convenience. Prefer an authenticator or a passkey when you can.

Passkeys. A passkey is a credential stored on your device (or in a password manager that supports them). To sign in, you approve on the device with a fingerprint, face scan or device PIN. No code is typed and no password is sent. Passkeys are tied to the website they were created for, which means a fake site cannot ask you for one, and that makes them resistant to phishing. See the FIDO Alliance’s explanation of passkeys for more background.

In Nubo, a sign-in with a passkey counts as complete authentication, so it does not ask for a second step afterwards. User verification (the fingerprint, face or PIN step) is required when you register and use one. You can register up to ten passkeys, which is useful for a phone, a laptop and a spare key.

Which should you choose?

For most people, the best answer is to use two methods.

• Best for ordinary users: a passkey on the phone or laptop they use most, plus an authenticator app or backup codes as a fallback.
• Best for people who share devices or travel: an authenticator app and printed backup codes.
• Best for people with higher risk (finance, administrators, anyone who handles customer data): a passkey on more than one device, and the authenticator as backup.

Whatever you choose, make sure the person has a way back in if they lose their device. That means backup codes, a second passkey, or an administrator who can help. Avoid depending on a single phone.

“Remember this device”

Nubo can remember a device for 30 days after you complete the second step, so you are not asked for a code at every sign-in on your own laptop. That is reasonable on a personal computer you control. Do not tick it on a shared or public machine. You can review the devices and sessions that are signed in to your account and sign out any of them.

Other protections that work alongside

Two-step verification is one layer. Nubo also does the following:

• Sign-in lockouts. Repeated wrong passwords make the account wait before it accepts another attempt. The wait grows with the number of failures. There are separate limits per account and per network address.
• New-device alerts. If someone signs in from a browser or system we have not seen, you receive an email with a “this was not me” link. The same applies to password changes, enabling or disabling two-step verification, adding a passkey, changing a recovery email and lockouts. You can switch some of these alerts off, but we recommend leaving them on.
• Session list. You can see your active sessions, revoke one, or sign out of all the others.
• Recovery. If you forget your password, a code goes to your verified recovery email. Resetting the password signs out all sessions and remembered devices. If your account has two-step verification, a reset does not by itself let someone sign in, because the second step is still needed.
• Re-authentication. Sensitive changes, such as adding a passkey or changing your recovery email, ask you to confirm with your password or a passkey again if you did not sign in a moment ago.

A practical tip: add a recovery email that you can reach and that is not on the same account. If you lose both, only an administrator can help.

Rolling it out to a team

Telling a team “please turn on two-step verification” works for the keen ones and fails for the rest. A short plan gets everyone there.

1. Announce it, with a date. Say why (account takeover is a common way businesses lose money and data), what is needed, and by when.
2. Set the policy. In Nubo, a team owner or administrator can require two-step verification for members. You choose a grace period in days. During the grace period, members see a banner reminding them. After the deadline, the app refuses everything except the pages needed to set up two-step verification and sign out, until they have enabled an authenticator or a passkey. Where a person belongs to several teams that each require it, the earliest deadline applies.
3. Offer a setup session. Fifteen minutes on a call, at a fixed time, with people setting up while you watch. It is faster than answering questions one by one.
4. Give a written guide with screenshots, covering the authenticator app and a passkey. Include a line on what to do if they lose their phone.
5. Cover the edge cases. Shared accounts should not exist: give each person their own. People without a smartphone need a hardware security key or a passkey on their laptop. People who travel need backup codes.
6. Check progress. Ask people to confirm in the team chat when they are done, and follow up personally with the stragglers before the deadline.
7. Plan the helpdesk. Decide who resets access when someone is locked out, and how that person verifies identity. A phone call or video call with someone who knows them is better than a chat message.

A checklist for administrators

• Everyone has their own account, with their own password.
• A password manager is recommended or provided.
• Two-step verification is required for the organisation, with a stated grace period.
• Each person has a fallback: backup codes or a second passkey.
• Recovery emails are set and verified.
• You know who can reset a locked-out member, and how they check who is asking.
• Departing staff are removed on their last day and their sessions are signed out.
• New-device alerts are left on.

For the wider picture of how we protect accounts, see the Security page and the Trust center.