Two Factor Login on Mars Market
Two factor login is the cheapest protection an account has. It accepts a TOTP code from any standard authenticator, with a PGP challenge as a backup. Turn it on the day you register, not after the first scare, and set up the backup while things are calm, because you will not remember the steps when you are locked out.
Setting it up
In your account settings, enable two factor. Scan the QR with any TOTP app, enter the six digit code to confirm, and you are done. The PGP challenge is the fallback for when the app is on a different device. Enable both, because relying on one path is how people get locked out at the worst moment.
The backup that matters
Write the recovery code down and store it somewhere that is not the same device as the browser you log in with. Paper, an encrypted file on a separate machine, anywhere offline. If your account can be recovered by a polite message, it can also be taken by a convincing one. The deliberate friction is the feature.
A fresh device counts as new
The storefront treats a login from a new device as a new circuit even when the passphrase matches. An unexpected sign in surfaces immediately rather than after the fact, which is why a stolen passphrase is not the end of the story if two factor is on.
Frequently Asked Questions
Which authenticator apps work?
Any standard TOTP app. The code is the same wherever you generate it.
What if I lose my phone?
Use the PGP challenge or the recovery code you wrote down. This is why the backup belongs offline.
Does two factor slow me down?
One extra code per login. That is the price of an account that survives a stolen passphrase.