Obsidian SuiteDocumentation
Obsidian Remote: all chapters

Docs / Obsidian Remote / Being supported

Two-factor sign-in

With two-factor sign-in, a password alone doesn't open a PC: whoever connects also needs the 6-digit code from an authenticator app (such as Microsoft Authenticator, Google Authenticator or 1Password). It is the best protection for PCs you reach unattended.

This chapter is about two-factor sign-in on a PC people connect to. Your own account on the Obsidian Remote server can have two-factor sign-in too; see The admin console.

Turn it on for a PC

On the PC people will connect to:

  1. Open Settings > Security.
  2. Under Two-factor sign-in, click Set up two-factor sign-in....
  3. Scan the QR code with the authenticator app, or type the key shown under it into the app by hand.
  4. Type the code the app shows into Code from the app and click Turn on.

If it says That code is not right - check the time on this PC and the phone., the clock on one of them is off: the codes depend on the time.

The page then says Two-factor sign-in is on. Only the person signed in at the PC or an administrator can set it up.

The authenticator app now holds the PC's secret, so whoever has that app can produce codes. For a team that supports a customer, scan the code into the authenticator your technicians share for that customer.

Connecting to a PC that uses it

After you type the password, the app asks for a Two-factor code: type the code for that PC from your authenticator app and click Verify.

Don't ask again on this PC is ticked to begin with: the PC then remembers your PC for 90 days and only asks for the password. Clear it on a PC that isn't yours. In the web viewer the same box is called Trust this browser.

Each code works only once. After 3 wrong codes the connection ends; start again with the next code.

After 10 wrong codes in all (from any computer, without a right one in between), the PC stops taking passwords: whoever tried may know the password. The main window there says Password sign-in is blocked in red. If it was not you, change the permanent password; then click Allow passwords again. Click to accept keeps working meanwhile, and the block stays if the PC restarts.

Accept doesn't need a code

Two-factor sign-in protects password sign-ins. When the person at the PC clicks Accept, they are the second factor, so no code is asked.

Remembered viewers

Settings > Security shows how many viewers the PC remembers. Forget remembered viewers makes all of them type a code again next time. Turning two-factor sign-in off also forgets them.

Turn it off

Settings > Security > Turn off two-factor sign-in. If your organization requires two-factor sign-in by policy, the button is greyed out.

If the phone with the authenticator app is lost, someone at the PC (or an administrator, through a session they can still open, for example by Accept) turns two-factor sign-in off and sets it up again with a new phone.

When your organization requires it

An administrator can make two-factor sign-in compulsory with the policy Require two-factor (see Policies). A PC that falls under that policy but has no two-factor sign-in set up takes no passwords: it offers only Accept, and a PC that takes nothing but passwords refuses the connection with The device must use two-factor sign-in, but it is not set up there yet. Its Settings > Security says so too. So set up two-factor sign-in on those PCs before the policy reaches them.