Two-factor codes next to the profile: what that changes

A platform asks for six digits at a login from an unfamiliar device, and an ad account often asks at every login at all. The digits live thirty seconds and appear wherever the app holding the key is installed, which is in your pocket.

The hands are your assistant's, and the permission to work comes from you, by hand. On three accounts that is nothing, on thirty it is your whole working day.

1. 1

   The password went through

   The platform asks for the second step and waits for six digits.

2. 2

   The digits live half a minute

   The window is short, and they have to go across at once.

3. 3

   The app sits with you

   The key is on your phone, and your assistant does the work.

A code is six digits for thirty seconds. A key is the short string you took off a QR picture once, back when you turned the protection on at the platform.

A code comes out of the key and the current time, and there is no road back: a dozen codes read over your shoulder will not give up the key. So a code you hand over costs you a minute, and a key you hand over costs the account until you bind the second step again.

The app on your phone does exactly the same: it holds the key and shows digits by the clock. The only difference is where the key sits and whose hand reaches it.

There are three ways in all, and you have probably walked two of them already. Forward every code by hand, give your assistant the key itself in a chat, or put the key where the profile opens.

The first runs into your time, the second into a chat you cannot recall. The third leaves the key on a machine rather than in somebody else's chat, and that alone is what separates it from the second.

The key already sits next to the account anyway: in a spreadsheet, in a note, in a shared password vault. Next to the profile it moves one step closer to the window where that account is actually used.

Then the digits appear in that same window, and the phone drops out of the work entirely. The app produces the code on this computer, and nothing goes out to the network for it.

The window does not show the key back: the One-time code window in the profile menu shows the digits, the seconds left and the account name, and the card carries only a 2FA mark. You paste it once, and after that you work with digits alone.

1. 1

   No second device

   The digits appear in the same window the profile lives in.

2. 2

   Nothing to look up

   The key belongs to the profile, so there is nothing to match by name.

3. 3

   Nothing to retype

   You copy the code with a button, and a flow types it into the form.

4. 4

   Nothing goes outward

   The key and the clock are on this computer, and a code needs no network.

A key by the profile means exactly one thing: whoever opens that profile gets into the account without you. That is the price, and it is worth saying out loud before you hand over the first profile.

On macOS and Linux only the owner of the computer account can read your keys in that file, and on Windows only the user folder closes them off. Against someone sharing the machine and against another program those are different barriers, and the second one is weaker.

A key cannot be revoked the way a password can: a password you change in a minute, while the second step has to be bound at the platform again. So handing the key over is a decision for the whole time you work with that person.

The key does not travel to the server: there is no such field there at all. Sign in on another machine and you will see the profile, but no key beside it, and a sync back does not wipe it either.

Cookies and a profile login are not accepted either: a body carrying such a field is refused whole. ARMANOS keeps the key, the cookies and the profile login on the machine where you put them, and sends them nowhere by itself. A shared folder for sessions is something you point at yourself, and then cookies and logins travel into it.

1. 1

   A server without that field

   The key is not there, and there is nowhere to take it from.

2. 2

   A login on a second machine

   The profile arrives, and the key stays on the first one.

3. 3

   A transfer under a password

   Only a profile archive carries the key, and your password opens it.

Shared access to a profile does not bring the key along: your assistant opens the profile from their own machine and finds no digits there. The key travels by two roads: a profile transfer with its session, whose file opens with a password you set, and a profile export with the Export button if you pressed «Include secrets» yourself. That second file has no password.

A copy of a profile does not take the key either: a copy is a new account, and somebody else's second step is no use to it. Another person's password does not open a transfer file at all, and an honest refusal comes back instead of the contents.

The session travels into the archive along with the profile: cookies, logins and the state of the sites. Your assistant sits down in a warmed profile instead of signing into thirty accounts again from scratch.

Most of the time the trouble is not the key but its settings. A bare key carries only the secret itself, while a whole otpauth:// string also carries the number of digits, the step and the algorithm, and an unusual platform sets those its own way.

The same key with eight digits, a sixty second step and SHA256 gives one code with those settings and a different one without them. An account looks lost after that, although what got lost was three fields.

The app turns down a string that counts logins rather than seconds the moment you paste it: time based digits will never come out of it. Spaces, dashes, lower case and equals signs in a key are no obstacle at all.

Your assistant types the digits into the same platform that expects them from a phone, and a disagreement has nowhere to come from: the step and the method are set by RFC 6238, one for everybody. Six reference samples of that standard, the farthest of them at a time of 20000000000 seconds, give exactly what the app on your phone gives.

The clock is a separate trouble: the digits follow this computer's clock, and a clock that has drifted gives what the platform does not expect. A few wrong tries in a row read as guessing, and the platform closes the entry itself after that.

You can leave the app on your phone switched on: two places holding one key do not get in each other's way and give the same digits. That is also how you check yourself on the first day.

The second step on a platform account and the second step on your own account are two different doors. The first you hand to your assistant along with the profile, the second you hand to nobody.

On your own login the same number does not work twice, ten misses shut the door for a while, and turning it on gives you ten recovery codes, each good once. Lose the phone and a recovery code lets you in, while your assistant gets in with neither.

With one assistant and three accounts, leaving it as it is comes out cheaper: your time on ten codes a day costs less than untangling things when you part. With thirty accounts, forwarding codes is the very work you hired a person for.

If you hand the account over for good, the key travels with the profile, and after you part the second step has to be bound again. If the account stays yours, hand over access to the profile and not the key.

There is a middle arrangement too: you hand over access to the profile and keep the key. Your assistant works in the profile, still writes to you at the second step, and every login stays your decision.