I read in the NYTimes that PayPal supports two-step verification, but I can't see where to set it up. How do I set up two-step verification in PayPal?
How to setup two step verification in PayPal
multi-factor-authpaypal
Related Solutions
If you click "Can't scan the QR code?" during device setup, the secret key is displayed.
You can then store that secret key VERY securely (think: printed in a safe, GPG encrypted with a strong key, or whatever) and add it to new devices without having to get all devices together and re-key them all at once.
If your secret key is exposed you lose all benefits of 2factor auth, so do not do this unless you have an extremely secure way of storing the secret. Mine's stored, but it's GPG encrypted on an SD card I keep locked up for disaster recovery. It's not going anywhere.
You still have to go through and re-configure once, to add your 2nd device and record the key securely, but after that you can add more devices with only the key.
Personally I don't recommend this; you're better off generating emergency recovery 2factor codes using the accounts UI and using them if you lose your device, rather than adding a 2nd device and adding to your attack surface. I've only done it because for various non-technical reasons I cannot keep the same device with me everywhere, and one of them is reset regularly.
It remembers your code for 30 days, but if your phone gets stolen, you just remove the "mobile application" (this means Google Authenticator) associated with your phone from the two-step settings page. This will immediately invalidate your code, and your phone browser will no longer log in*.
This is what the setting looks like in my account:
This does mean that you need to remember to remove at least two things should your phone get stolen: Your Google Authenticator application, and the application-specific password for your phone. You might also have other application-specific passwords to remove.
This also applies to any other device containing a logged in browser (like a laptop). The code will remain valid for 30 days unless you remove the Google Authenticator application in the settings. If it wasn't your phone that was stolen, you can immediately register the Google Authenticator application again and you will get new code to use.
*This is my understanding of how it works but so far as I can see this is not spelled out in Google's documentation anywhere.
Related Topic
- PayPal and Skype – How to Delete Skype Billing Agreement on PayPal
- Google 2-step verification recovery
- PayPal – How to Track Periodic Payments with PayPal
- PayPal Receipt – How to Prevent Buyer from Seeing Company Name
- Google-account – have application-specific passwords without 2-step verification for the Google account
- How long does bank verification take with PayPal
- How to unlock PayPal account without phone
- Google-account – How to add trusted devices to Google two-step verification
Best Answer
It's done in your settings:
Profile → My Settings → Security Key → Get Started → Get Security Key
You can either pay for a physical token that will display your one-time password (OTP) key, or you can register a mobile phone, the instructions are right there.
Note: to register a phone it needs to be able to receive text messages, as that is how the OTP is sent.