Two-factor sign-in

Two-factor sign-in adds a second step after your password: a 6-digit code from an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, Authy or any other. The code keeps changing, so someone who learns your password still cannot get in without your phone.

It applies to signing in to SightHub on the web. The mobile app is not affected — it uses biometrics.

Who has to use it

You use two-factor sign-in if any one of these is true:

• Your practice requires it for everyone — a manager switched it on in Settings → Security.
• A manager requires it for you — the MFA required box is ticked on your employee record.
• You turned it on yourself from your Account — anyone can, even when it is not required.

If it is required and you have not set it up yet, SightHub walks you through it the next time you sign in.

Setting it up at sign-in

This is what you see when two-factor is required but you have no app yet. Have your phone with you.

1. Sign in with your username and password as usual.
2. The card changes to Set up two-factor sign-in and shows a QR code.
3. Open the authenticator app on your phone, add a new account, and scan the QR code. If the camera will not scan it, use the line under the code — Can't scan? Type this key in the app — and type that key into the app instead.
4. The app now shows a 6-digit code for SightHub. Type it into Code from the app.
5. Tick Remember this device for 30 days if this is a computer you use every day (see Remembered browsers below).
6. Press Turn on and sign in.
7. The card shows Two-factor sign-in is on and a list of recovery codes. Save them now — see the next section. Then press I saved them — continue and you are in.

Recovery codes

Recovery codes are your spare keys. If you lose your phone, each one signs you in once instead of the app code. They look like k7mpq-2xw9r.

They are shown only once, right after you turn two-factor on (or ask for new ones). Under the list:

• Copy — copies them all, so you can paste them somewhere safe.
• Download — saves a small text file called sighthub-recovery-codes.txt.
• Print — prints them on paper. If the browser blocks the print window, use Download instead.

Keep them away from the phone itself — on paper in a drawer, or in a password manager. Each code works once; your Account shows how many are left.

Signing in with a code

Once two-factor is on, every sign-in has two steps:

1. Sign in with your username and password.
2. The card shows Enter your code: Open your authenticator app and enter the 6-digit code for SightHub.
3. Type the current code into Code from the app (or a recovery code). If you do not have your phone, type one of your recovery codes here instead.
4. Tick Remember this device for 30 days if you want to skip this step on this computer.
5. Press Sign in.

Back to password returns to the ordinary login form.

What the messages mean:

• Wrong code. Enter the current 6-digit code from the app (or an unused recovery code). — the code was mistyped, already expired, or the recovery code has been used before. Wait for the next code in the app and try again.
• The sign-in took too long. Enter the password again. — the code step only lasts a few minutes. Start again from the password.
• Two-factor sign-in was reset. Enter the password again. — a manager reset your two-factor while you were signing in. Sign in again; you may be asked to set up the app afresh.

Five wrong codes lock the account for five minutes, exactly like five wrong passwords. You are sent back to the password form with a countdown on the button. See Signing in.

Remembered browsers — and the PIN

Ticking Remember this device for 30 days (no code here, and PIN sign-in works) when you enter a code does two things on that one browser:

• for 30 days you sign in with just the password — no code;
• the Express Login PIN works there.

The second point matters at the front desk. With two-factor on, the PIN works only on a remembered browser. Anywhere else it answers PIN sign-in needs a trusted device. Sign in with your password and the app code once, and tick "Remember this device". So on a shared front-desk computer, sign in once with password and code, tick the box, and the PIN works there from then on.

Only tick the box on a computer that belongs to the practice — never on a home or public computer someone else uses.

Your Account — the Two-factor sign-in card

Click your name at the bottom of the sidebar and choose Account. On the Security tab, under the password and PIN cards, is Two-factor sign-in.

The first line tells you where you stand:

• Off — two-factor is not on for you.
• On — with Since (when you turned it on) and how many recovery codes are left.
• · required by your manager or · required for everyone by your organisation — added when you are not allowed to switch it off.

Turning it on yourself

1. Press Turn on.
2. Scan the QR code with your authenticator app (or type the key under it).
3. Type the 6-digit code the app shows and press Turn on. Cancel backs out without changing anything.
4. Your recovery codes appear. Save them, then press I saved them.

From your next sign-in, SightHub asks for the code.

New recovery codes

Used most of your codes, or worried someone has seen them? Press New recovery codes, type a current code from the app (or one of your remaining recovery codes) and press Get new codes. You get 10 new codes; the old ones stop working at once. Save the new ones the same way.

Turning it off

Press Turn off, type a code from the app (or a recovery code) and press Turn off again. Your recovery codes and remembered browsers are removed too.

The Turn off button is not there when two-factor is required for you — by your manager or by the whole practice.

Remembered browsers

While two-factor is on, the card lists every browser you ticked Remember this device on — for example Chrome on Windows — with when it was added, when it was last used, and when the 30 days run out.

• The bin icon on a row forgets that one browser. Next time it asks for the code again, and the PIN stops working there.
• Forget all does the same for every browser at once.

Use Forget all if you think someone else has been using one of your remembered computers.

Lost or new phone

Not required for you, and you still have a recovery code:

1. Sign in with your password and a recovery code instead of the app code.
2. Go to Account → Security → Two-factor sign-in, press Turn off and confirm with another recovery code.
3. Press Turn on and set it up again with the new phone.

Required for you, or no recovery codes left: you cannot turn it off yourself. Ask a manager to reset it (next section). After the reset:

• if two-factor is required for you, you set up the app again at your next sign-in;
• if not, you sign in with the password only until you turn it on again.

You can still sign in with a recovery code while you wait for the manager.

For managers — the employee record

Open the person in Employees. On the User Details tab there is a Two-factor sign-in card.

• MFA required — tick it to make two-factor compulsory for this person. If they have no app yet, they set one up at their next sign-in. Left unticked, they can still turn it on for themselves. Press Save at the bottom of the form to apply it (Create Employee on a new record). On a new employee the box starts ticked or unticked according to the practice's default.
• If Settings → Security requires two-factor for everyone, the card says so: Settings → Security requires two-factor for everyone, so this employee needs it either way. The tick box then makes no difference. This line only shows to someone who can open Settings; without that access the card stays silent, but the rule still applies.
• Authenticator app: set up / not set up — whether the person has actually finished setting up their app.
• Reset MFA (only when the app is set up) — for a lost phone. It removes the person's authenticator app, recovery codes and remembered browsers. Confirm in the window that follows. The message tells you what happens next: either the employee sets up a new app at the next sign-in (when two-factor is required for them) or the employee signs in with the password only.

Reset MFA does not change the person's password. If they have also forgotten the password, use Reset password at the top of the record as well.

Good to know

• Recovery codes are shown once. If you close the list without saving them, sign in and press New recovery codes to get a fresh set.
• Changing phones? Do it while the old phone still works. If two-factor is optional for you, turn it off and on again from the Account card with the new phone. If it is required, ask a manager for Reset MFA and set up the new phone at your next sign-in.
• Two-factor does not replace the password. You still need both, and five wrong attempts at either lock the account for five minutes.

Related

• Signing in
• Security settings — two-factor for the whole practice
• Employees — accounts, time cards and schedule