Setting up your second factor

This is what a player does, once.

/lock setup

You are asked to pick: an authenticator app, or a PIN.

An authenticator app

The stronger of the two, and the one to require of staff.

1. Run /lock setup and choose the app option.
2. A secret key appears in chat. Copy it.
3. In Google Authenticator, Authy, 1Password, Bitwarden or whichever app you use, add an account by entering a key by hand, and paste it in.
4. The app starts showing a six-digit code that changes every thirty seconds.
5. Type that code to confirm: /lock code 123456.

That is enrolment finished. From then on the same app answers every challenge.

A slow phone still works

One step of clock drift is accepted either side, so a phone that is a few seconds out still produces a code the server takes.

A PIN

Simpler, and enough for ordinary players.

1. Run /lock setup and choose the PIN option.
2. A keypad opens. Tap your digits, then the green tick.
3. Tap them once more to confirm.

The digits are in a different place every time the keypad opens. Someone recording your screen learns nothing from where you clicked.

Recovery codes

Ten single-use codes are issued when you enrol. Save them somewhere that is not your phone. If you lose the phone, one of these gets you back in; without them, only an admin can clear your enrolment.

See them again with /lock recovery. Each one works once and is then dead.

Being challenged

When you join from a device the server does not know, the prompt appears and nothing else works until you answer. Move, chat, commands, breaking, placing: all held. You also cannot be hurt or targeted while you answer, so nobody can kill you at a login screen.

Answer with the keypad, or with /lock code <code> if you use an app.

You have ninety seconds. Five wrong answers locks the account for fifteen minutes, and staff are alerted.

Remembering a device

After a successful answer you can have the server remember the device for thirty days, so you are not challenged every single time you play. Only the device is remembered: the moment your address changes, you are asked again.

• /lock trust remembers this one.
• /lock forget drops every remembered device, everywhere. Use it if you have logged in somewhere you should not have.

Turning it off

/lock remove

Removes your own second factor, unless staff have made it mandatory for your rank. Removal is always written to the audit trail.