Purelymail
AccountSign up
Search documentation

Two Factor Authentication

Two Factor Authentication (2FA) can be used to improve the security of your account. When enabled, you need two things to log in: your password (the first factor), and a generated code from an app or device (the second factor).

This makes your account harder to hijack, since if one of your factors is stolen, you can still rely on the other to keep you safe.

Methods

We support two methods: Time-Based One-Time Passwords (TOTP) and Security keys.

Time-Based One-Time Passwords (TOTP)

This is usually an app on your phone which generates a code that changes every minute. To log in, you simply enter that code after entering your password.

You can use any TOTP app you want. Google Authenticator (Android or iPhone) is an adequate choice. When you add a new TOTP method, we provide you with a QR code you can scan or a link you can click to add your new method to Google Authenticator.

Security Keys

A security key is usually a USB device or other compatible service. It uses cryptography and some manual action from you (possibly a button press) to ensure security. To add a security key, make sure you are using a recent version of your browser, and follow instructions when your browser prompts you.

Why not SMS codes?

SMS codes are fairly insecure and are expensive to send. Phone numbers are not designed to be secure identifiers, and attackers may be able to perform a "SIM port hack" to steal your phone number and thus account.

Is 2FA a substitute for using a strong, unique password?

It mitigates some of the risk of using a weak and reused password, but you should still use a strong and unique password anyway.

App Passwords

If you enable Two-Factor Authentication but need to use a third party IMAP or POP3 client that does not support it, or if you want to limit whatever a client can do with your user, then you should create an App Password. App Passwords are generated login passwords which can be used everywhere but our website, and they allow you to access your user on these services.

Each App Password has "scopes" that control what it can be used for. The available scopes are:

  • IMAP: Access to view your emails which are stored on the server.
  • SMTP: Access to send emails from your user and any authorised addresses to send from.
  • POP3: Access to retrieve and download emails from the server. (We generally advise against this protocol since your emails are then no longer stored safely on our server, but only on the machine you downloaded them from).
  • SIEVE: The Manage Sieve protocol allows you to manage the Sieve filtering for your user. This gives you advanced control over the flow of emails.
  • DAV: This is to allow access to CalDav and CardDav, which are the protocols for Contacts and Calendar for your user.

While scoping does protect your account in case the App Passwords are ever leaked, you should still keep these passwords safe and not share them with anyone.

If you are just trying to use Apple Mail, Thunderbird, or any other mail app, you will typically want the IMAP and SMTP scopes. If you are trying to use Contacts or Calendar, you would want the DAV scope. If you want to add the user as a sending user for a service, then you would just want the SMTP scope.

  • EMAIL CLIENTS: Email clients should use IMAP and SMTP. Email clients are your Thunderbird, Apple Mail, Outlook and other email clients. These are applications that let you send and view your emails.
  • SEND ONLY SERVICES: Services that need to send emails but don't need to see any can use just an SMTP scoped App Password. If that service is ever compromised, it can't be used to read your mailbox.
  • CONTACTS OR CALENDAR: Services that need access to your contacts and calendar like DavX5, would require the DAV scope. This ensures they can access the directory with your contacts and calendar data.

Note that spaces don't matter in an app password.

Backup Codes

Backup codes are one-time use codes you can use for the Two-Factor Authentication step, in case you lose your access to your other methods. You should keep them in a safe place.

Backup codes can only be used by the user or administrative portals, not webmail or IMAP.

Trusted Devices

The "Trusted Devices" section in the user management section shows devices for which you have active Webmail sessions. You can revoke their trusted status at any time.

Trusted Devices will expire three months after last use, or one week after last use if another device with the same IP is active.