At Uptime a code by email is enough to sign in. If you want to protect your account further, you switch on the authenticator app in the settings. This article explains how that works together and why “remember this browser” is so narrowly defined.
How signing in works then
- You enter the code from the email.
- Instead of being signed in, a second prompt follows: the code from your authenticator app. It is valid for five minutes, for at most five attempts.
- An app code that has already been used cannot be used again, not even in a different sign-in. After five failed attempts per account within five minutes you have to wait.
The second check is switched on per account, not automatically for everyone. During setup you scan a QR code and receive ten recovery codes with which you can sign in if your phone is missing.
Why a second factor at all
Whoever controls your mailbox can sign in with the email code. The second factor comes from another device and another source. In its cheat sheet OWASP names multi-factor authentication as by far the best defence against the majority of password-related attacks, including credential stuffing and password spraying.
Convenience with limits: remember this browser
Typing an app code every time is tedious on your own computer. So the app-code prompt has a checkbox “Remember this browser for 30 days”. It is not ticked by default. If you tick it, this applies:
- The browser receives a cookie that scripts cannot read (HttpOnly), that is only sent with requests from the same site (SameSite=Strict) and that is also marked Secure over HTTPS.
- It is valid for exactly 30 days and is not extended, not even with each sign-in.
- It replaces only the app prompt. You still need the email code.
- It is only created if you signed in with the app code, not with a recovery code. An emergency route should not leave a lasting shortcut.
- Signing out does not remove the trust. That is intended, otherwise the checkbox would be pointless.
Overview and revocation
Under Settings → Security you see all remembered browsers with name, date remembered and expiry date; your current browser is marked. You can forget single browsers or all of them. Sessions that are already signed in stay as they are, but every further sign-in asks for the app code again. The name is shown as plain text only.
Security changes such as switching off the app or generating new recovery codes always require a fresh app code or an unused recovery code. A remembered browser is not enough for that.
Status
Two-factor sign-in is available in every account: you switch it on in the settings under Security.
