The second factor

Besides the password, every sign-in requires a temporary code (TOTP) generated by an authenticator app.

• It is set up at the first sign-in: until then, the account cannot be used from the browser.
• The second factor comes with recovery codes, for when the phone is unavailable.
• Password recovery goes through email and also requires the second factor: access to the mailbox alone is not enough.