A Second Step After Password, Google and GitHub Sign-In

What's changed

• If two-factor authentication is on, signing in with Google or GitHub now asks for the code from your authenticator app, or a recovery code, before you are signed in. It used to skip the code
• If your account has a passkey and no authenticator app, a correct password or a Google or GitHub sign-in is no longer enough: we ask for one of your passkeys first. Signing in with a passkey on its own still needs no second step
• When your passkey is out of reach, choose Email me a code instead and we send a 6-digit code to the address on your account. It works once, in the browser that asked for it, for 10 minutes and five tries; after five wrong codes the emailed code is paused for 15 minutes and we email you to say so
• An emailed code is weaker than a passkey or an authenticator app, because anyone who can read your email can use it, so add an authenticator app as well. With one, sign-in asks for its code or a recovery code as before and never offers the emailed code
• Accounts created with Google or GitHub can now set a password, turn on two-factor authentication and sign out their other browser sessions. Each used to ask for a password those accounts never had, and now accepts the 6-digit code we email instead
• If your account has neither two-factor authentication nor a passkey, the console shows a reminder to add one, and Profile > Sign-in and security says so too. Choose Remind me in a week to hide it for seven days; it comes back until you add one
• The two-factor page now checks your authenticator code as soon as all 6 digits are in, with no need to press Verify. Recovery codes still need Verify