Just turn on your smartphone - open the Authenticator application - and you'll immediately see the security code required to log in, valid for the next 30 seconds only. It's really easy, but the increase in security is immense.
As long as you've got your phone, this will ensure only YOU are able to login, and nobody else. No other person is able to generate the security code as it's generated using a unique secret key only known to your phone. You can't log in if you don't have the security code. You can't log in if you don't have the password. You always need the password and the security code to log in. This makes it almost impossible for hackers to log into your Magento backend.
Setting up Two-Factor Authentication for an adminstrator in Magento is easy: Just go to the Users section in the Magento backend, click Create secret key
and scan the barcode using the Authenticator application. That's it! Your account is now protected against unauthorized logins.
Get the Two-Factor Authentication extension now to protect against today's threats without the hassle and cost of yesterday's technology.
Disable Two-Factor Authentication for known IP addresses: Simply enter the IP addresses you don't want to use Two-Factor Authentication for in the Magento admin. This especially makes sense if you've got a static IP address and don't want to enter your secret key when logging in from a known and trustworthy IP address.
This extension is compatible with iPhone (iOS 7+), iPad, iPod touch, Android and BlackBerry smartphones. The extension uses the free open-source Google Authenticator application to generate the security code required to log in.
Before your purchase, please make sure your device is able to run the Authenticator application.
Android: Open the Android Market and search for Google Authenticator
iPhone/iPad/iTouch: Visit the App Store and search for Google Authenticator
BlackBerry: Visit http://m.google.com/authenticator on your BlackBerry
Magento Backend Login
iPhone Application (Screen 1: Security code generation; Screen 2 & 3: Setting up the code, required once only - Click to zoom)
The secret key will only be saved on your smartphone. Neither XTENTO nor Google will be able to recover it. The magic all happens on your device.
If you ever lose your smartphone, be sure to create a new key in the Two-Factor Authentication section under 'Users' in Magento so no one is able to log in using your smartphone.
This extension does not guarantee a 100% protection against hackers. If someone hacks your FTP server, they will be able to disable the security code login, but if that ever happens, they'd be able to download your database anyways without Magento backend access.
If you have any questions regarding this module, please don't hesitate to contact us
Frequently Asked Questions & Support
More information about this extension and answers for frequently asked questions can be found in our Support Wiki