Enabling multi-factor (MFA) or two factor authentication (2FA)


Multi-Factor (MFA) or Two-Factor Authentication (2FA) adds an additional layer of authentication to your Freethought account by requiring information in addition to the password in order to login. We recommend that you use MFA/2FA on your Freethought account, and indeed any website or service that supports it as using MFA/2FA means that even if your password is stolen or otherwise compromised, an additional layer of security must be passed to gain access to your account. 

This article will guide you through enabling Time-based One-Time Password (TOTP) Multi-Factor Authentication to your account using the Authy mobile application. We also support SMS based authentication, but recommend against using it wherever possible as it is a lot less secure than TOTP.
Other MFA/2FA apps are available such as Google Authenticator, Microsoft Authenticator and Duo. TOTP is an open standard and so there are many apps which can use it. They generally work in more or less the same way, so this guide will roughly apply to any authenticator app.

To get started with Authy, download it for your device:

Get it on Google Play
Download on the App Store

Login to your customer portal account at https://portal.freethought.uk, then click where it says your name at the top right of the screen:

d328b2daeae3e43fd8fd6c226e0b92315f834a9e5cdbe84e2c84925cd50ddea3172d6cb5487111f2?t=a630292426719de828640ea148be5453
Next, click "Security Settings" in the drop down menu:

557ad8840ae4c0a6c62d063f73f7e32d321e0e1fef392495fc955211d320a0c52e21048a21721aea?t=a777c2814a354cd4218333050e17fe38

Then click the green button under the "Two-Factor Authentication" heading at the bottom that says "Click here to Enable":

e99a87c173b2375d3c920ba84296346f6e2ff5fd526400f2308e75c0756a416b26c444ca33641b11?t=e6eb2f190e451b8925b8ba2deb791334

We want to use Time Based Rokens as these are more secure, so select that option, and press "Get started":

20e9a0afa4b48c14a7b7ab9596c833c60c567bbe7d02d9710242bfed3a1436964a59c91bbd70e3ef?t=26d4a58d4c2306e3ecfa8f78cf10220e

You will be presented with a screen like this:

41dc9c9c5227ab48d99fa3b0d4013a33c753ccaca204d95da8cd7de3956050bf798c30e5462b7612?t=dcb20f276a1a9d04975a2c3992f565c8

Open the Authy app that you installed earlier. If this is the first time you've opened it, you may be prompted to setup the app by entering your mobile number. Once you have completed this process, you can tap the red plus icon in the middle of the screen or the square in the bottom left in order to add account:

f82c639cca68f383ca6bde17f5433d8ea3a72e24a5a2590e0a9c3bfa81e78ea91f1f202246f6665d?t=0572fad8204c2d7eafcbb910032f598c

Now, tap the button to "Scan QR Code". This may prompt you to give permission to access the camera, in which case you will need to allow this. Then point the camera at the QR code displayed in the customer portal:

bad9504a7cc83d034b5fffb818054c2ee6f48c406b405199d29c61b3dd8d41b5718c86215afff8e1?t=9905d7d2f3a1224856f1ea079f0d9684

Now you'll be given the option to set an image and Nickname for this code in the Authy app. Set this as you wish and tap "Save".

You will now see a code with a countdown timer next to it. Enter the displayed code into the customer portal 2FA setup screen where it says "Enter authentication code" and click on the blue "Submit" button:

3e0d9d020e96e10f64dc6411e4d91611e71ba03b82a60c17068ac82af26c79fc6a0fe30f6fab2fee?t=136117bea42709e4ef247b48f886ae5f

d55dda54e4c6bfbf5b2845950ff9e5805a5217c843e9ccfe34d201226e8d29c63b83dd0833c40e75?t=5c8df7ae717f55a1b3b8fe2e800ee241

You will now be shown a green confirmation message to let you know that 2FA is now setup properly:

c04a5a0878674c65777647205e8e905a562127cee4e9c991c2fcb9963056c44d57368529d0500151?t=f9a753cf5be5ad2cda9171ce3ea00edc

Beneath this message is a backup code, you should write this backup code down and store it somewhere securely. Should you ever loose your authenticator app or the device it is installed on, you can use this backup code to remove the 2FA requirement, without it gaining access to your account will be extremely difficult.

⚠️ Write down your backup code and store it securely and safely somewhere, you NEED this backup code ⚠️

Click close, and you're done!  🎉

Every time you login to the Freethought customer portal from now on, you will be prompted for your username and password plus your 2FA code from the app. You should never give this two factor code to anyone, not even Freethought staff.

514809dd3b4e3df4b91cee0860a476e14946281e8172ebb6ed078075ba7696d041d93187b7aed3e2?t=269abb2bed11302b071f973568e9abe1

Your Freethought account is now secure and protected with Time-based Multi-Factor Authentication, huzzah! 👍