Two Factor Authentication

Will the Church consider two factor authentication for login in the future? I personally use it where I can and use a third party authenticator. This seems especially important for unit leaders who have access to a great deal of private information via their login.

They already do in certain citations. A code is sent to your mobile number.

If you go to LDSAccount.LDS.org, on the left you will see an option "Two-Step Verification." You can choose to receive a verification code by text, or through an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy).

sbradshaw wrote:If you go to LDSAccount.LDS.org, on the left you will see an option "Two-Step Verification." You can choose to receive a verification code by text, or through an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy).

This is not available for all accounts.

sbradshaw wrote:If you go to LDSAccount.LDS.org, on the left you will see an option "Two-Step Verification." You can choose to receive a verification code by text, or through an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy).

I saw that at one time, but when I went back to respond to this thread, it was gone.

Thanks, I did not know that was there, I will enable it. I did check, the option was there on my account, it may have to do with your calling.

Kudos to whoever enabled the two step auth - you (all) deserve a raise!

I just saw a new notice on the LDS Account sign-in page that two-step authentication is now available. I assume that means that it's now available for all users!

From: https://ldsaccount.lds.org/help/twoStepVerification
"To improve security for all Church applications, like Online Donations and Ward Directory, check the box to “Enable Two-Step Verification to all Church applications”.
Without this selected, only LDS Account and a few applications that require Two-Step Verification will use this additional security measure.
Note: Some Church applications are not configured to handle Two-Step Verification at this time."

Does anyone have more information on this?
What applications will require two-step verification if I leave the defaults? What applications will not work if I enable "require for all"?

I can't scan the code I need for my third party indicator on my new phone to access my account who would I talk talk to in my ward?

I've loaded the app and used the QR scan, but now it keeps brining up a different 6 digit code every time the round pie shape circle completes and it doesn't stop. What is this?

srasmussen wrote:I've loaded the app and used the QR scan, but now it keeps brining up a different 6 digit code every time the round pie shape circle completes and it doesn't stop. What is this?

That is the 6 digit code you have to enter when requested after you put in your username and password. The fact that it changes every 30 seconds or so is to "prove" to the website that you still have the same device with you when you turned on the two factor authentication (and by extension you are who you say you are). Type fast.

How do I change the phone number used in the two step verification?

How does a person do the two step verification if he has no cell phone?

ERHaroldsen wrote:How does a person do the two step verification if he has no cell phone?

Looking at the Two Step Verification help page, I don't think there's any options for that.

ERHaroldsen wrote:How does a person do the two step verification if he has no cell phone?

If you have an iPod touch, iPad, Android tablet, newer Kindle Fire, or newer Chromebook, you can install the LDS Authenticator app on any of those. Or, you may be able to find a third-party authenticator app that runs on a desktop computer or in a browser. But any of those options will require you to have a personal device that you carry with you whenever you might be signing in. If that's not an option, you probably won't be able to use two-factor authentication.

sbradshaw wrote:If you have an iPod touch, iPad, Android tablet, newer Kindle Fire, or newer Chromebook, you can install the LDS Authenticator app on any of those.

Can any of those work if there's no internet connection present? I realize one must have internet connection to have a need to sign in, but one might be at work and not allowed to connect a personal device. Or perhaps in the clerk's office which has marginal WiFi.

If not, then that's something else to consider before enabling it.

Yes, LDS Authenticator, as well as some third-party apps like Google Authenticator, work offline. You won't receive a push notification, like you can when you're online with LDS Authenticator, but if you open the app on your device there will be a time-based code that you can type in.

To change the phone number for the text verification, go to:

https://account.activedirectory.windows ... oofup.aspx

We are going to use a dedicated cell phone that stays in the office.

Apparently I turned on two factor authentication but never set up the app. However, it is still wanting me to give it a code to get into my account settings and I do not have one and it is not giving me the option to get a text to my phone. How can I get it turned off so I can fix this problem.

crazeemarchese wrote:Apparently I turned on two factor authentication but never set up the app. However, it is still wanting me to give it a code to get into my account settings and I do not have one and it is not giving me the option to get a text to my phone. How can I get it turned off so I can fix this problem.

I have a similar problem...I set up 2-factor with google authenticator and it worked great until I changed phones. Now I can't sign in to my account settings and there are no other verification options. Can anyone help me out on this?

The first post in this (the LDS Account) forum has a link to the official LDS Account support page:

https://tech.lds.org/forum/viewtopic.php?f=92&t=30383

If none of the questions and answers help, there are tips on getting to a web form to request specific help from support personnel.

A quick Google search suggest Move Google Authenticator from one Android device to another.

To me, this isn't a "church" problem as much as it is a Google Authenticatior issue.

russellhltn wrote:A quick Google search suggest Move Google Authenticator from one Android device to another.

To me, this isn't a "church" problem as much as it is a Google Authenticatior issue.

Those instructions are for updating two-factor auth for a Google account on the new device. They don't provide any help with migrating other accounts to a new device.

If the old device is no longer available, the user doesn't have a copy of the shared secret used to generate the TOTP codes, and there is no other authentication method available, the only solution I know of is to contact the GSC to have two-factor auth disabled on the account so that it can be reconfigured.

scgallafent wrote:Those instructions are for updating two-factor auth for a Google account on the new device. They don't provide any help with migrating other accounts to a new device.

Hmmmm. Given how many steps were involved, I thought it moved everything over.

That's certainly a disincentive.

So what is the GSC and how do I contact them?

nhaddock wrote:So what is the GSC and how do I contact them?

The Global Service Center. Ask your ward clerk to contact them and make the request for you, if you are not able to find a way at the ldsaccount.lds.org site.

Is there a way to turn off "Two Factor Authentication"? When I was required to change my password, this created all sorts of mayhem between the Church's website and Family Search. The only way I can sign in with Family Search now is to go through my Church account. It is more annoying than timely. My password doesn't work on Family Search. I have tried several things. Please give me guidance on this. I'm trying so hard to do Family History, and this isn't helping.

The Family Search password is now independent of your Church Account password. You can sign in with your Church Account using the separate button on Family Search's login page or you can sign in with a family search password, whichever is more convenient for you.

scgallafent wrote: Mon Mar 12, 2018 9:45 pm

russellhltn wrote:A quick Google search suggest Move Google Authenticator from one Android device to another.

To me, this isn't a "church" problem as much as it is a Google Authenticatior issue.

Those instructions are for updating two-factor auth for a Google account on the new device. They don't provide any help with migrating other accounts to a new device.

Here are some instructions for transferring all codes that are set up in Google Authenticator from one device to another:
https://www.alphr.com/transfer-google-authenticator-codes-new-phone/

conniestauffer wrote: Thu Apr 14, 2022 8:10 am Is there a way to turn off "Two Factor Authentication"?

You can disable Two Factor Authentication by visiting this page in Church Account and unchecking "Opt in to Two-Step Verification" at the top:
https://account.churchofjesuschrist.org ... entication

My husband's account is requiring two factor authentication, but he does not have a cell phone. Is there a way to set it for a landline or email?

rodolan wrote: Thu Apr 28, 2022 11:29 am My husband's account is requiring two factor authentication, but he does not have a cell phone. Is there a way to set it for a landline or email?

The only options are see are:

• Send a text message to a device (landline won't work)
• Okta Verify App
• Google Authenticator App or OTP Fob
• Security Key or Built-in Authenticator

The last two are a possibility. It means you'd have to buy some hardware. The OTP Fob generates a number that keeps changing over time. You'd enter the number as the second factor. The security key would be a bit of hardware you'd have to plug into the computer.

I don't have any details beyond what's in the listing for 2 step sign in.

I am unable to receive the OTP code to access my church account, I keep pressing resend but no response

Iamuchenna wrote: Fri Feb 10, 2023 12:38 am I am unable to receive the OTP code to access my church account, I keep pressing resend but no response

Are you sure MFA is configured to send the code to a phone or email address where you would be able to see the message with the code? Very often, the phone number or email address will have changed, which breaks MFA.

The 'please read first' announcement thread at the top of the Church Account forum might have useful information: viewtopic.php?t=30383 Most likely, you'll need to have your ward/branch clerk give you the phone number for the Global Services Department. After they verify your identity, GSD can disable MFA to allow you to get into your account and reconfigure MFA if you wish.

how do i access my account if i no longer have my 2FA registered number?

Oseie3646 wrote: Tue Feb 28, 2023 11:37 am how do i access my account if i no longer have my 2FA registered number?

Answered in the post immediately before yours.