Using an authenticator app

What it actually is

A password can be guessed, reused or phished. Two-factor authentication adds a second thing you have to hold (your phone), so a stolen password on its own is not enough to reach your pipeline.

The method BidWise uses is called TOTP, a time-based one-time password. When you set it up, BidWise and your phone agree on a single shared key. From then on your app combines that key with the current time to produce a six-digit code, and BidWise does the same sum at its end. Matching answers prove you are holding the right device.

Two things follow from that, and they tend to surprise people. The codes are generated on your phone rather than sent to it, so they work with no signal and no wifi. And because the time is half the sum, each code is only valid for 30 seconds.

Choosing an app

TOTP is an open standard, so any of these will work with BidWise, and with your bank, your email and everything else that offers it. Pick one and use it for all of them.

• Microsoft Authenticator

  Free. The natural choice if your organisation already runs Microsoft 365.

• Google Authenticator

  Free, and the most widely used. Fine if you have no other preference.

• 1Password, Bitwarden or similar

  If your team already uses a password manager, it can almost certainly hold codes too, and sync them across your devices.

• Authy

  Free, with its own backup, so a lost phone is less painful.

Setting it up

1. 1

   Install an authenticator app

   Any of the apps above will work. They all follow the same open standard, so you are not tied to one vendor. Install it on the phone you normally carry.

2. 2

   Scan the QR code

   BidWise shows a QR code when you first sign in. In your authenticator app choose Add account, or the + button, and point the camera at it. The app adds an entry called BidWise.

3. 3

   Or type the key instead

   If the camera will not cooperate, use the setup key printed underneath the QR code. Choose the manual or "enter a setup key" option in your app and type it in. It produces exactly the same result.

4. 4

   Enter the six-digit code

   Your app immediately starts showing a six-digit number for BidWise. Type it into the box to confirm the two are paired. That is enrolment finished, and you only do it once.

Signing in from now on

Enter your email and password as usual, then open your authenticator and type the six-digit code showing against BidWise. You will be asked for a code on each new sign-in. It costs a few seconds, and it is what stops a leaked password becoming a leaked bid library.

When something goes wrong

The code was rejected

Almost always timing. Codes last 30 seconds, and one that is a second from expiring is often refused. Wait for the app to roll over to a fresh code and enter that, without the space some apps show in the middle.

It keeps being rejected

Check the clock on your phone. The code is derived from the current time, so a handset whose clock has drifted will generate codes that are genuinely wrong. Switching on automatic date and time fixes it.

I have no signal

It will still work. Codes are calculated on your device from the key and the clock, and nothing is sent anywhere, so aeroplane mode, a dead spot or a foreign SIM make no difference.

I have a new phone

If you kept the setup key, add BidWise on the new phone using the manual option and you are back. Password managers and Authy generally carry your codes across for you.

I have lost the phone and the key

Email hello@bidwise.co.uk from your work address. Access cannot be restored automatically, which is rather the point, so it is handled as a manual identity check.