Files.com offers several 2FA methods from which your users can select for their 2FA protection.

Users may add multiple 2FA methods to their accounts and have multiple active simultaneously.

Files.com recommends hardware security keys and authenticator apps as the primary 2FA methods. Use SMS and email only as fallback options.

Hardware Security Keys

A hardware security key is a physical device, usually a small USB token. Files.com supports the following hardware security key authentication methods.

Yubikey WebAuthn (Preferred)

This is the 2FA method recommended by Files.com for the greatest security. This method does not support FTP/SFTP/DAV connections. Learn more about Yubikeys.

WebAuthn is compatible with the previous FIDO U2F standard.

Yubikey Native

This method uses the OTP (One-time Password) feature of your Yubikey. This method supports FTP/SFTP/DAV connections. Blue Yubikeys are not supported.

Hardware Key (WebAuthn)

This includes non-Yubikey hardware keys that support WebAuthn. This method does not support FTP/SFTP/DAV connections.

Authenticator Apps That Use TOTP (Time-Based One-Time Password)

These include apps such as Google Authenticator, Duo, and Authy. Authenticator apps are typically installed and used on mobile devices. This method supports FTP/SFTP/DAV connections.

TOTP codes are time-based and expire in under a minute. Your device clock must stay accurate - if the difference between your device and Files.com is more than a few seconds, authentication fails even when the code appears correct. Enable automatic time synchronization (NTP) on your device to prevent clock drift. If a code is about to expire, wait for the next one before submitting.

SMS (Text Messages)

SMS-based 2FA is less secure than hardware security keys and authenticator apps, but still safer than a password alone.

With this method, Files.com sends a one-time code by SMS to the phone number configured for the user's 2FA each time they attempt to log in.

Each code is valid for 10 minutes and can only be used once. After a code is used or expires, it becomes invalid. At the next login attempt, Files.com automatically sends a new code by SMS.

SMS depends on phone carriers and third-party delivery networks. That makes it more exposed to interception, SIM swap attacks, and phone-number reassignment issues than device-based methods.

SMS is also less reliable. Delivery can be delayed or blocked by carrier issues, roaming issues, or regional outages. Because one-time codes are time-sensitive, delays can prevent successful login.

Use SMS only when a hardware security key or authenticator app is not practical.

This method supports FTP/SFTP/DAV connections, though not usefully, because a code is only issued during a web sign-in. Use an authenticator app for accounts that connect over those protocols.

Email Verification

Email verification is the weakest 2FA method Files.com offers. Use it only when a hardware security key, Yubikey, or authenticator app is not possible.

With this method, the user enters a code that Files.com sends by email each time they attempt to log in.

The verification code and the password reset link travel to the same place. Files.com sends both to the user's primary email address. An attacker who controls that mailbox can reset the password and collect the verification code, so the two factors collapse into a single credential.

That gap sits exactly where 2FA is supposed to help. Password Recovery via Email warns that a compromised mailbox lets an attacker reset a Files.com account, and recommends 2FA as the defense. Email verification is the one method that does not supply it.

Email verification still defeats an attacker who has only a stolen or reused password, so it beats having no second factor at all.

Each code works exactly once. While a code is still unused, repeated login attempts within its 10 minute window expect that same code rather than generating a new email. Once a code has been used, or once 10 minutes have passed, the next login attempt causes Files.com to email a fresh one.

Email delivery can be delayed by spam filtering, mail routing issues, provider outages, or local mail server policies. Because each code is short-lived, delayed delivery can make the code unusable before it arrives.

This method does not support FTP/SFTP/DAV connections.

Changes to Supported 2FA Methods

When a Site Administrator updates the list of supported 2FA methods and disables a previously allowed method, users who are currently using that method can still complete their next login with it. After signing in, they will be required to configure at least one 2FA method from the remaining supported methods. The disabled method will no longer be available for future use. Users who already have another supported 2FA method configured can continue signing in with that method without interruption.

When a site administrator enables an additional 2FA method, existing users are not affected. They can continue signing in with their current 2FA methods, and the newly supported method becomes available in their profile settings for optional setup.