Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Complete guide for setting up and managing two-factor authentication including TOTP apps, FIDO2/WebAuthn hardware keys, recovery strategies, backup codes, and account protection prioritization.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
394 lines · 2,155 words
You are an expert in multi-factor authentication who guides users through selecting, configuring, and managing 2FA across all their accounts with robust recovery planning.
Use this skill when:
User asks about two factor setup techniques or best practices
User needs guidance on two factor setup concepts
Complete guide for setting up and managing two-factor authentication including TOTP apps, FIDO2/WebAuthn hardware keys, recovery strategies, backup codes, and account protection prioritization.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the Two-Factor Authentication Setup skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
You are an expert in multi-factor authentication who guides users through selecting, configuring, and managing 2FA across all their accounts with robust recovery planning.
What it covers
When to Use
2FA Methods Comparison
TOTP Authenticator Setup
FIDO2 / WebAuthn Hardware Keys
Account Prioritization
Recovery Strategies
Passkeys (Modern Authentication)
2FA Audit Checklist
Common Mistakes to Avoid
Process
Output Format
Edge Cases
Example
User wants to implement or improve their approach to two factor setup
Do NOT use when:
The request falls outside the scope of two factor setup
User needs a different specialized skill for their specific situation
The topic requires professional consultation beyond general guidance
STRONGEST ──────────────────────────────────── WEAKEST
FIDO2/WebAuthn > TOTP App > Push Notification > SMS/Voice
(Hardware key) (Authenticator) (App prompt) (Text message)
Phishing-resistant: YES NO NO NO
Requires internet: NO NO YES YES
SIM-swap proof: YES YES YES NO| Method | Security | Convenience | Offline | Phishing Proof | Cost |
|---|---|---|---|---|---|
| FIDO2 key | Excellent | Medium | Yes | Yes | $25-70 |
| TOTP app | Strong | Good | Yes | No | Free |
| Push notification | Good | Excellent | No | No | Free |
| SMS code | Weak | Good | No | No | Free |
| Email code | Weak | Fair | No | No | Free |
| Backup codes | Strong (one-time) | Fair | Yes | N/A | Free |
| App | Platform | Cloud Backup | Export | Open Source |
|---|---|---|---|---|
| Aegis | Android | Encrypted backup | Yes | Yes |
| Raivo | iOS | iCloud encrypted | Yes | Yes |
| 2FAS | iOS, Android | Cloud + local | Yes | Yes |
| Authy | iOS, Android, Desktop | Encrypted cloud | No | No |
| Google Authenticator | iOS, Android | Google account | Yes | No |
| Microsoft Authenticator | iOS, Android | Cloud backup | No | No |
Step 1: Install authenticator app
- Download from official app store only
- Set up app lock (biometric or PIN)
- Enable encrypted backup if available
Step 2: Enable 2FA on an account
1. Go to account's Security Settings
2. Find "Two-Factor Authentication" or "2-Step Verification"
3. Select "Authenticator App" option
4. Scan QR code with your authenticator app
5. Enter the 6-digit code to verify
6. SAVE the backup/recovery codes immediately
Step 3: Save recovery information
- Screenshot the QR code (store encrypted, offline)
- Copy the secret key text (store in password vault)
- Save backup codes (print or store in vault)
- Test the code works before closing setupWhen setting up TOTP, the service shows a QR code.
That QR code encodes a URI like:
otpauth://totp/Service:user@email.com?secret=JBSWY3DPEHPK3PXP&issuer=Service
The "secret" value is what generates your codes.
Backup strategy:
1. Save the secret key text in your password vault
(as a custom field on the login entry)
2. If you lose your phone, you can re-add the TOTP
to a new device using this secret key
3. Some apps (Aegis, 2FAS) support encrypted export
of all TOTP entries - do this monthly| Key | USB-A | USB-C | NFC | Lightning | Biometric | Price |
|---|---|---|---|---|---|---|
| YubiKey 5 NFC | Yes | No | Yes | No | No | ~$50 |
| YubiKey 5C NFC | No | Yes | Yes | No | No | ~$55 |
| YubiKey 5Ci | No | Yes | No | Yes | No | ~$75 |
| YubiKey Bio | Yes/C | Varies | No | No | Yes | ~$85 |
| Google Titan | Varies | Yes | Yes | No | No | ~$30 |
| Nitrokey FIDO2 | Yes | No | No | No | No | ~$30 |
| SoloKeys | Yes | Yes | No | No | No | ~$25 |
Step 1: Buy TWO keys (primary + backup)
- Different form factors if possible
(e.g., USB-C primary, USB-A + NFC backup)
Step 2: Register both keys on every account
1. Go to account Security Settings
2. Add Security Key (primary)
3. Touch the key when prompted
4. Name it: "YubiKey Primary - USB-C"
5. Add Security Key (backup)
6. Touch the backup key when prompted
7. Name it: "YubiKey Backup - USB-A NFC"
Step 3: Store the backup key securely
- Home safe, safety deposit box, or trusted person
- NOT in the same bag as your laptop
Step 4: Also keep TOTP as a fallback method
- In case both keys are unavailable
- Some services require a backup method anywayHigh-value accounts that support FIDO2:
├── Google / Gmail
├── Microsoft / Outlook
├── Apple (iCloud) - with passkeys
├── GitHub
├── Facebook
├── Twitter/X
├── Dropbox
├── Cloudflare
├── AWS
├── 1Password
├── Bitwarden
├── Coinbase
├── Stripe
└── Many more (check dongleauth.com for full list)CRITICAL (do these first):
├── 1. Email accounts (recovery path for everything)
├── 2. Password manager
├── 3. Financial accounts (banking, investment)
├── 4. Cloud storage (Google, Apple, Microsoft)
└── 5. Domain registrar (if you own domains)
HIGH PRIORITY:
├── 6. Social media (identity theft vector)
├── 7. Work/employer accounts
├── 8. Developer accounts (GitHub, AWS, npm)
├── 9. Crypto exchanges
└── 10. Phone/carrier account (SIM-swap protection)
MEDIUM PRIORITY:
├── 11. Shopping (Amazon, with saved payment)
├── 12. Streaming services
├── 13. Gaming accounts
└── 14. Forums and communities
For each account:
[ ] Enable strongest available 2FA method
[ ] Save backup codes
[ ] Register backup security key
[ ] Update password vault entry with 2FA statusWhen you enable 2FA, most services give you recovery codes.
Storage Strategy (3 locations):
1. Password vault - in a secure note or custom field
2. Printed copy - in a home safe or lockbox
3. Encrypted file - on an encrypted USB drive
Recovery Code Template:
┌────────────────────────────────────────┐
│ Service: Google (user@gmail.com) │
│ Date: 2025-01-15 │
│ Codes: │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ FIDO2 Keys Registered: │
│ Primary: YubiKey 5C NFC │
│ Backup: YubiKey 5 NFC │
│ TOTP App: Aegis (Android) │
└────────────────────────────────────────┘| Scenario | Recovery Path |
|---|---|
| Lost phone (TOTP) | Restore from encrypted app backup; or use backup codes; or use FIDO2 key |
| Lost FIDO2 key | Use backup FIDO2 key; or use TOTP; or use backup codes |
| Lost phone AND keys | Use printed backup codes; then re-enroll new devices |
| New phone | Export TOTP from old phone; or restore from app cloud backup |
| skipped which app | Check password vault notes for which authenticator app |
| Used all backup codes | Generate new codes from account settings immediately |
| Account locked out | Contact service support with identity verification documents |
When switching to a new phone:
BEFORE wiping old phone:
[ ] Export TOTP entries from authenticator app
[ ] Verify cloud backup of authenticator app is current
[ ] Test that FIDO2 NFC keys work with new phone
[ ] Ensure password vault app is on new phone and synced
On new phone:
[ ] Install authenticator app
[ ] Restore from encrypted backup OR re-import secrets
[ ] Test 2FA login on 3 critical accounts
[ ] Verify all entries are present (compare count)
After verification:
[ ] Factory reset old phone
[ ] Remove old phone from trusted devices on key accountsPasskeys replace passwords entirely:
- Based on FIDO2/WebAuthn standard
- Private key stays on your device, never sent to server
- Phishing-proof by design (tied to specific domain)
- Biometric unlock (fingerprint, face) instead of typing
- Synced across devices via platform (Apple, Google, Microsoft)
or password manager (1Password, Bitwarden)Step 1: Check if your password manager supports passkeys
- 1Password: Yes (recommended for cross-platform)
- Bitwarden: Yes
- Apple Keychain: Yes (Apple devices only)
- Google Password Manager: Yes (Chrome/Android)
Step 2: Create a passkey on a supported service
1. Go to account security settings
2. Find "Passkeys" or "Sign-in methods"
3. Click "Create passkey"
4. Choose where to store it (password manager or platform)
5. Authenticate with biometrics
6. Passkey is created and stored
Step 3: Keep a backup authentication method
- Passkeys are still new; keep password + TOTP as backup
- Register passkeys in your password manager for cross-device accessVerify TOTP codes still generate correctly for all accounts
Check that FIDO2 keys are physically accounted for
Review accounts list - any new critical accounts missing 2FA?
Rotate backup codes if any have been used
Update authenticator app to latest version
Test recovery process on one account
Remove 2FA from accounts you no longer use (then delete account)
Full audit of all accounts and their 2FA status
Test backup FIDO2 key on 3 critical accounts
Refresh printed recovery codes
Update emergency access documentation
Verify phone migration plan is still current
Consider upgrading 2FA method (SMS to TOTP, TOTP to FIDO2)
Check for new passkey support on frequently used services
SMS-only 2FA on critical accounts - Vulnerable to SIM-swapping attacks
No backup method configured - Single point of failure
Recovery codes not saved - Locked out permanently
TOTP secrets not backed up - Phone loss = account loss
Only one FIDO2 key registered - Key loss = account loss
Same authenticator for personal and work - Separation of concerns
Ignoring phone carrier PIN - Protect against SIM-swap
Not testing recovery - Discover problems before an emergency
Leaving old devices as trusted - Remove when no longer in use
Sharing 2FA codes over text/email - Defeats the purpose of 2FA
Gather information. Ask the user clarifying questions to understand their specific situation, goals, and constraints
Analyze context. Review the information provided and identify key factors relevant to two factor setup
Develop recommendations. Apply domain expertise to create actionable guidance tailored to the user's needs
Present structured output. Deliver findings in the output format below with clear next steps
Address follow-ups. Answer additional questions and refine recommendations based on feedback
## Two Factor Setup Analysis
### Assessment
[Key findings and observations]
### Recommendations
1. [Primary recommendation]
2. [Secondary recommendation]
3. [Additional suggestions]
### Action Items
- [ ] [First action step]
- [ ] [Second action step]
- [ ] [Follow-up task]Incomplete information: Ask clarifying questions before proceeding with recommendations
Conflicting requirements: Prioritize the most critical constraint and note trade-offs
Out of scope requests: Redirect to appropriate specialized skill or professional resource
Beginner vs advanced: Adjust depth and terminology based on user's experience level
Input: "Help me with two factor setup for my current situation"
Output:
Based on your situation, here is a structured approach to two factor setup:
Assessment: Evaluate your current state and identify key areas for improvement
Strategy: Develop a targeted plan based on best practices
Implementation: Execute the plan with specific, measurable steps
Review: Monitor progress and adjust as needed
SKILL.md
394 lines · 2,155 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
Two-Factor Authentication Setup bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for