Files.com offers several 2FA methods from which your users can select for their 2FA protection.

Users may add multiple 2FA methods to their accounts and have multiple active simultaneously.

Files.com recommends hardware security keys and authenticator apps as the primary 2FA methods. Use SMS and email only as fallback options.

Hardware Security Keys

A hardware security key is a physical device, usually a small USB token. Files.com supports the following hardware security key authentication methods.

Yubikey WebAuthn (Preferred)

This is the 2FA method recommended by Files.com for the greatest security. This method does not support FTP/SFTP/DAV connections. Learn more about Yubikeys.

WebAuthn is compatible with the previous FIDO U2F standard.

Yubikey Native

This method uses the OTP (One-time Password) feature of your Yubikey. This method supports FTP/SFTP/DAV connections. Blue Yubikeys are not supported.

Hardware Key (WebAuthn)

This includes non-Yubikey hardware keys that support WebAuthn. This method does not support FTP/SFTP/DAV connections.

Authenticator Apps That Use TOTP (Time-Based One-Time Password)

These include apps such as Google Authenticator, Duo, and Authy. Authenticator apps are typically installed and used on mobile devices. This method supports FTP/SFTP/DAV connections.

TOTP codes are time-based and expire in under a minute. Your device clock must stay accurate - if the difference between your device and Files.com is more than a few seconds, authentication fails even when the code appears correct. Enable automatic time synchronization (NTP) on your device to prevent clock drift. If a code is about to expire, wait for the next one before submitting.

SMS (Text Messages)

SMS-based 2FA is less secure than hardware security keys and authenticator apps, but still safer than a password alone.

With this method, Files.com sends a one-time code by SMS to the phone number configured for the user's 2FA each time they attempt to log in.

Each code is valid for 10 minutes and can only be used once. After a code is used or expires, it becomes invalid. At the next login attempt, Files.com automatically sends a new code by SMS.

SMS depends on phone carriers and third-party delivery networks. Someone who gains access to your messages, transfers your number to another SIM without your permission, or receives a reassigned number may receive your verification codes. These dependencies make SMS less secure than device-based methods.

SMS is also less reliable. Delivery can be delayed or blocked by carrier issues, roaming issues, or regional outages. Because one-time codes are time-sensitive, delays can prevent successful login.

Use SMS only when a hardware security key or authenticator app is not practical.

This method supports FTP/SFTP/DAV connections, though not usefully, because a code is only issued during a web sign-in. Use an authenticator app for accounts that connect over those protocols.

Email Verification

Email verification is the weakest 2FA method Files.com offers. Use it only when a hardware security key, Yubikey, or authenticator app is not possible.

With this method, the user enters a code that Files.com sends by email each time they attempt to log in.

The verification code and the password reset link travel to the same place. Files.com sends both to the user's primary email address. A person who controls that mailbox can reset the password and collect the verification code, so the two factors collapse into a single credential.

Password Recovery via Email explains how mailbox access affects password resets and recommends an independent second factor. Email verification does not provide that separation.

Email verification still prevents someone who has only a stolen or reused password from signing in, so it is stronger than having no second factor at all.

Each code works exactly once. While a code is still unused, repeated login attempts within its 10 minute window expect that same code rather than generating a new email. Once a code has been used, or once 10 minutes have passed, the next login attempt causes Files.com to email a fresh one.

Email delivery can be delayed by spam filtering, mail routing issues, provider outages, or local mail server policies. Because each code is short-lived, delayed delivery can make the code unusable before it arrives.

This method does not support FTP/SFTP/DAV connections.

Changes to Supported 2FA Methods

When a Site Administrator disables a previously allowed 2FA method, users who have no other supported method set up can still authenticate with their existing method to enroll a replacement. This lets them prove their identity using the method they already set up, without requiring an administrator to reset their 2FA. They must complete setup of a supported method before normal access resumes. The disabled method remains until that setup is complete; an unfinished setup does not count as a replacement.

Users who already have another supported 2FA method configured can continue signing in with that method without interruption.

When a site administrator enables an additional 2FA method, existing users are not affected. They can continue signing in with their current 2FA methods, and the newly supported method becomes available in their profile settings for optional setup.