To further protect your profile, you can enable login verification. Login verification adds an extra layer of security using one-time passwords generated by another device (such as your phone or a security key). Thus in order to access your profile, an attacker will need to have access to your device as well as knowing your user name and password.

Supported login verification methods

SimpleID supports two methods of login verification methods:

  • Time-based One-time Password (TOTP), which typically uses an authenticator app on a smart phone
  • WebAuthn-based authentication, which uses a phyiscal security key.

Note

If you enable WebAuthn-based authentication, you will also enable support for passkeys, which allows you to log in without a password or additional login verification.

What you need

For TOTP-based login verification, you will need a device (such as a smartphone) with an authenticator app that supports RFC 6238 Time-based One-time Password Algorithm. Examples of smartphone apps support this algorithm include:

  • Google Authenticator
  • Microsoft Authenticator
  • FreeOTP

For WebAuthn-based authentication, you will need a physical security key such as a Yubikey.

Important

Non-hardware security keys such as Windows Hello and iCloud Keychain cannot be used for login verification. Instead, they can be used as passkeys.

How to enable

TOTP-based login verification

  1. Login verification is implemented in authentication scheme modules. For TOTP-based login verification this is SimpleID\Auth\OTPAuthSchemeModule. To enable this module, open the config.php file and add the appropriate module names under modules.
  2. Log in to SimpleID
  3. From the My Profile page, go to the Login Verification box, then click Enable.
  4. Enter the key shown on the page into your device. If your device supports scanning QR codes, you can also scan the QR code shown.
  5. Enter the 6 digit verification code shown on your device and click Verify.
  6. If shown, save the recovery codes in a same place.

Login verification is then enabled. Every time you attempt to log in using this account, you will be prompted to enter the 6 digit verification code shown on your device.

WebAuthn-based login verification

  1. Login verification is implemented in authentication scheme modules. For WebAuthn-based login verification this is SimpleID\Auth\WebAuthnAuthSchemeModule. To enable this module, open the config.php file and add the appropriate module names under modules.
  2. Log in to SimpleID
  3. From the My Profile page, go to the Passkeys and security keys box, then click Add.
  4. Enter a user-friendly name for the key, then click Add security key.
  5. Follow the instructions on your device and insert your security key.
  6. If shown, save the recovery codes in a same place.

Login verification is then enabled. Every time you attempt to log in using this account, you will be prompted to insert the security key (and enter a PIN if required).

How to disable

  1. Log in to SimpleID
  2. From the My Profile page, go to the Login Verification box, then click Disable.

Recovery codes

If you are enabling login verification for the first time, a list of recovery codes will be shown at the conclusion of that process. These recovery codes can be used to recover your account if you have lost the device that generates the verification code.

Make sure you copy and save the recovery codes in a safe place. They are only shown once.

To use a recovery code:

  1. When prompted to enter a verification code, click Use a recovery code.
  2. Enter one of the recovery codes you have saved, and click Verify.
  3. If successful, you will be logged in normally. Once a recovery code has been used it cannot be used again.

If you have lost your recovery codes or have used all of them up, you can regenerate the recovery codes by going to the Dashboard, then the Recovery codes box, then click Reset.