Two-Factor Authentication in the Vault: A Practical Guide
The old way of sharing a 2FA-protected account was: one person has the authenticator app, everyone else texts them for codes. That's terrible. Here's the better way.
Storing the TOTP secret
When you add a shared account, paste the TOTP secret (or scan the otpauth URI). WarpDesk stores it in the vault the same way it stores the password.
What renders in the UI
Each vault card shows the current 6-digit code and a 30-second countdown ring. The ring turns red in the last five seconds so nobody types a code that's about to expire.
Why this is safer than group chats
Group-chat codes leave a permanent record in your least-secure surface. Vault-derived codes leave no trace outside the vault itself.
The threat trade-off
You're trading one risk (codes floating in chat threads) for another (vault access gives you both password and second factor). That's why 2FA on the WarpDesk account itself matters.
How to add the WarpDesk account's 2FA
Enable it from your profile. This protects the vault — including the stored TOTPs inside — with a second factor at the auth boundary.
Recovery codes
When a service issues one-time recovery codes at 2FA setup, drop them into the entry's notes field. That's the safest place they'll ever live.
Legacy SMS 2FA
If a service only offers SMS, WarpDesk can't help you share the second factor — texts go to one phone. Push for TOTP wherever the service supports it.
Rotating a compromised secret
Regenerate on the service, update the vault entry, and the new secret is live for every member instantly. No chat threads to update.
A worked example
A family shares an airline account with mandatory TOTP. Before: one parent gets every login code request. After: any adult can complete a login when booking, without waking the other one up.
What we don't handle yet
Hardware security keys as a shared second factor. That's fundamentally not shareable — it's a physical object. For services that require FIDO, you'll want a per-user account.