Security4 min read
Two-factor on the account that controls everything
The panel account can delete every server you own. Why a password alone is not enough, which second factor to choose, and how to not lock yourself out.
Your servers are protected by whatever protects the account that administers them. That account can stop, wipe and delete everything, so the honest way to think about the password is that it is the only thing standing between a stranger and all of it.
Which second factor
- An authenticator app: good, free, and works when your phone has no signal.
- A hardware key: better, and the only option that resists a convincing fake login page.
- SMS: better than nothing and the weakest of the three, because phone numbers can be taken over.
Do not lock yourself out
Save the recovery codes somewhere that is not the phone running the authenticator. A password manager or a piece of paper both work. The common failure is not an attacker; it is a new phone and no codes.