After your password, Denkploeg asks for a code from an authenticator app on your phone. A password can leak without anyone noticing; a code that is valid for thirty seconds cannot. You turn it on yourself in My account.
Who has to have it
For some accounts it is mandatory, because behind their sign-in are the keys and the signatures of clients:
- Owners and admins of a workspace. Makers and readers choose for themselves.
- All members of an agency.
- Platform admins, always and without a grace period.
If a workspace, an agency and the platform ask for different things, the strictest one counts.
A grace period first
A new rule gives seven days of grace, counted from the moment it starts to apply to you. During the grace period you see a bar above your screen with the number of days and a button to set it up right away. After that, setting it up is the first step when you sign in: you cannot skip it, only cancel and sign out. The screen walks you through scanning and the first code, and afterwards you keep ten recovery codes.
Setting up within 30 minutes
Once you have scanned the code, you have 30 minutes to enter the first code. After that the setup expires and you start again. The screen says how many minutes are left.
Entering the code when you sign in
Type the six digits or paste them: the screen continues by itself. If you do not have your phone with you, choose Use a recovery code. After three wrong tries you see a tip (is the time on your phone right?). Below the field is Lost your code? with what you can do then.
Recovery codes and a new phone
In My account you make new recovery codes: you give your password and a code from the app, the old codes stop working and you see the new ones once. You get an email. You link a new phone with your password and a code from the old device (or a recovery code). The old device keeps working until you have entered the first code from the new one; that link also stays ready for 30 minutes.
Turning two steps off also asks for your password and a code from the app (a recovery code does not count): anything that weakens security asks for a code. If the second step is required for you, it cannot be turned off.
What an owner can set
A workspace chooses who has to have the second step (everyone, owners and admins, or nobody) and how many days of grace a new rule gives, under Access. An agency does the same in its settings (the agency owner). A workspace can also choose that every signature at level R3 asks for a code. Making it stricter is always possible. Making it looser asks for a code from the app of the person doing it, and so also a second step. Every change appears in the trail with a name.
Confirming again when signing
For signatures that cost money, cannot be undone or make something public, Denkploeg asks for a code from the app once more after Sign. See Signing and approving.