Choosing a second step
The second steps a TDACorp account supports, how strong each is, which extra steps do not count as two-factor, and how to pick.
On this page
A second step is a further proof you give after your first one. It protects you when your first proof leaks, for example when your password is guessed or reused. TDACorp accounts offer a few options, and they are not equally strong. This page helps you choose, in plain terms.
The options#
| Option | What you do | Counts as two-factor | Protects against |
|---|---|---|---|
| Passkey | Approve with your device lock. | A passkey that checks your device lock is already strong on its own and needs no second step. | Phishing, guessing, leaked passwords. |
| Authenticator app | Type the six digit Code from your authenticator app. The code changes every 30 seconds. | Yes | A stolen or guessed password. Not a fake page that also collects the code in real time. |
| Recovery code | Type one of the codes you saved, where your organization allows it. Each works once. | A fallback for the authenticator app, not a daily method. | Losing the authenticator app. |
| Use my password as an extra step | After an emailed link or a linked-account sign-in, you also type your password. | No | Someone who can open your email but does not know your password. |
| Email me a code as an extra step | After you type your password, an eight digit code is emailed and you type it in. | No | Someone who knows your password but cannot read your email. |
| Email me a code instead (lost passkey) | When a passkey is your only second step and you cannot use it, the same emailed code stands in for it. The platform offers it; you do not turn it on. | No: it signs you in one level lower than a passkey. | A lockout from a lost passkey, at a cost: someone who knows your password and controls your mailbox could use it, so your other addresses are told. |
No text message or voice call code is offered. The platform leaves it out on purpose.
Two kinds of step#
Real second factors are the passkey, the authenticator app and the recovery codes. They are what the sign-in page means by Your account asks for a second step, and a sensitive action asks for a passkey or an authenticator code when it says Confirm it is you. If you signed in with a passkey or through a linked account that checked a second factor, the dialog also offers Account password under Other ways to confirm. A session that started with your password, an emailed link or recovery does not get that option. A recovery code, where your organization allows it, is for signing in when you have lost the others. It is not accepted under Confirm it is you.
Extra steps are the two optional ones at the bottom of the table. They sit on the Two-step verification page under Extra steps, each with an On or Off badge. Both say the same thing in plain words: neither counts as two-factor verification. They do not replace a passkey or an authenticator app where one is required, and they do not count as a second factor when you recover your account. When one of them asks you for something at sign-in, the page repeats the warning: This is an extra step you turned on. It adds a check, but it does not make your sign-in two-factor.
The page also says what each does and does not do.
- The password step does not make sign-in stronger against someone who already knows your password.
- The emailed code step does not make sign-in stronger against someone who controls your mailbox, because the code goes to the same mailbox.
Both are available only where your organization allows them, so you may not see the section at all.
How to choose#
- Start with a passkey. It is the strongest option and needs no second step. See Add a passkey.
- Add an authenticator app to your password. That gives your account a real second factor: it is asked for when a sign-in looks unusual, when an application or organization requires it, and before sensitive actions, and it is what lifts the limit of a password-only session. A correct password alone still signs you in on a browser your account knows. Turn it on from Security, then Two-step verification, then Set up an authenticator app.
- Create recovery codes the moment you turn the app on, and store them safely. See Keeping recovery codes safe.
- Use the extra steps only as a bonus. Do not count them as protection against phishing.
What the setup looks like#
For the authenticator app: scan the QR code with your authenticator app, or type the Setup key into it, type the six digit Code from the app and select Turn on. If these are your first recovery codes, the page shows them right then. If your account signs in with a password only, the page first asks for your current password. The full steps are in Security and passkeys.
To stop using the app, select Turn off and confirm. Turning it off signs your other devices out.
If you lost your only passkey#
If a passkey is your only second step, the sign-in page can offer Lost your passkey? We can email an 8-digit code to the address you are signing in with instead., with an I lost my passkey link to account recovery. It is a way back in, not a second factor. The sign-in is one level lower than a passkey sign-in, and the page says that some apps will still ask for your passkey. Your other verified addresses are told when you use it, or the page says You have no other verified address, so nobody else can be told. A session that began this way cannot end your other sessions, leave organizations, accept or decline invitations, add an email address, cancel a recovery, revoke an application's access or mark security events read until you confirm with a passkey or an authenticator code. If you keep an authenticator app, you are offered it and your recovery codes instead, not this. See Security levels explained.
Why passkeys are preferred over a code#
An authenticator code is something you type, so a fake page that asks for your password and then your code can pass both on to the real site in the moment. A passkey cannot be handed over that way. If you must pick one, pick the passkey. If you can have both, a passkey plus an authenticator app on a separate device is a good pair.
What the platform asks you to confirm#
Changing how you sign in is itself a sensitive action. To open the security settings the page asks for a second factor used within the last 30 minutes (the platform can shorten that window, never lengthen it), under the heading Confirm it is you to open security settings. It is not a sign of a problem. The same applies when you add or remove a passkey, change a password, turn the app on or off, or create new recovery codes. The platform also emails a security alert for each change. See What a security alert email means.
A new browser may have to wait#
Where it applies, a password-only sign-in can add a sign-in method only from a browser your account has known for 24 hours (the platform can lengthen that wait, never shorten it). A sign-in that used a passkey or a second factor is not held back. A browser the account has not seen shows This browser is new to your account and asks you to use a familiar browser or come back later. The extra steps follow the same rule. A browser becomes known only through a sign-in that proved more than the password (a passkey, an authenticator code, or a link or code emailed to you); a password alone never does, so sign in once with an emailed link or code and come back after a day.