Two factor authentication and session management

If you have a Tilaa VPS, we recommend that you enable free two-factor authentication (2fa), which is a standard benefit offered with all our VPSs. This article will help you understand all advantages of 2fa with your VPS.

An extra layer of security with 2fa

Account hijacks are an increasing problem and they can be a serious threat to the security of your Tilaa account. For example, your client PC could be infected with a keylogger or one of your users is the unsuspecting victim of a phishing attack.

To avoid threads or hacks, we recommend you to protect your Tilaa account by enabling 2fa. You can enable 2fa with several popular authentication methods. These are some options:

Authenticator apps

To use 2fa, you can choose an authenticator app such as Authy. This is a free app for smartphones and other mobile devices which generates time-base one-time passcodes (TOTP). Other TOTP apps (such as Google Authenticator and Microsoft Authenticator) are off course also supported.

YubiKey

Looking for an even higher level of security? Then you can also consider YubiKey. A YubiKey can not easily be compromised. It requires a hardware dongle, which you can order online. Be sure to order one which supports ‘YUBIKEY OTP’.

💡 Mobile number is needed for 2fa on your Tilaa account

To set up 2FA you will need to submit and verify your mobile phone number with an SMS code first. Should you somehow loose access to your 2FA device you can disable 2FA using your mobile phone number as a fallback mechanism.

Account administrators can configure a global 2FA policy which will be enforced for all users under the customer account.

Trusted devices

For some devices you trust you might want to skip two-factor authentication. For example, when using our webapp on your smartphone it’s quite a hassle to copy/paste a code from your 2fa app to your mobile browser each time you log in. So, you can choose to add a device to the trusted device list during the 2fa process. Please note, that this at odds with the principle of 2fa.

You can review your trusted device list and remove devices individually you don’t want to trust anymore. Account administrators can remove trusted devices for all users under the customer account.

Security notifications

For account modifications that could potentially indicate an account compromise, we will send email notifications. Examples of a possible account compromise are

• When 2fa is disabled for an account
• When a device has been added to the trusted device list
• If the login password has been changed

🗝 Extra safety tip: Tilaa offers session management

Assume you signed into your Tilaa account on a public computer and then forgot to log out. Oops! This might provide an opportunity for someone to exploit your account.

 

Fortunately, Tilaa allows you to see a list of active login sessions and shut out other login sessions. Just login at Mytilaa check all logins with session management.