Two-factor authentication
Not yet enabled
Optional for your role, but it costs a minute and removes a whole class of risk.
Three steps
Turn it on
-
1
Open an authenticator
Google Authenticator, 1Password, Authy, Bitwarden — any of them. Choose “add account”, then “enter a setup key”.
-
2
Enter this key
3U4T KVTI N36M VX7T 65PT 643T CBCH E7HD
Account Neha Pillai · type time-based · 6 digits · 30 seconds. On this device, “Open in app” hands the key over directly.
-
3
Prove it works
Nothing is saved until a code from your phone matches. That is deliberate — enrolling from an unverified key is how people lock themselves out of their own restaurant on a Friday night.
Three secrets
And what each is for
Password
Typed once per shift, in a back office. Argon2id.
Authenticator code
Proves the device is yours at sign-in. Never reused.
Terminal PIN
Typed on a tablet in front of guests, where it will be observed. Separate on purpose — shoulder-surfing a PIN must not yield account access.
How the code is checked
Compared in constant time, so timing reveals nothing
Accepted within ±30 seconds of drift, no wider
Consumed once — a replay inside the same window fails
Five wrong codes destroys the challenge, not just the attempt
The secret is AES-256-GCM encrypted at rest
Still to come
A scannable QR for enrolment. The setup key works in every authenticator today via manual entry, and “Open in app” handles it on the device itself — a QR is a convenience, not a gap in the security.