Security - your password, multi-factor authentication, and * the browsers that skip your MFA code. Changing the password or turning MFA * off takes your current password; you are emailed either way. */ require_once "includes/inc_all_user.php"; $me = userRow($session_user_id); $has_mfa = trim((string) $me['user_token']) !== ''; $forced = intval($me['user_config_force_mfa']) === 1; $browsers = userRememberedBrowsers($session_user_id); $remember_days = max(1, intval($config_login_remember_me_expire)); ?>

Password

You're signed out once it's changed, to sign in with the new one.

Multi-factor authentication

Required by your administrator' : '' ?>
Signing in takes your password and a code from your authenticator app. Signing in takes only your password. With MFA it also takes a code from an app on your phone - so a stolen password alone doesn't get anyone in.
New phone? Turn it off, then on again with the new one. New phone? Ask an administrator to reset your MFA - you set it up again at your next sign in.

Remembered browsers

1) { ?>
  • A browser' ?> This browser
    Remembered from ยท skips the code until
None. Tick Remember me when you enter your code at sign in, and that browser skips the code for days. None - browsers are remembered once MFA is on, so you're not asked for a code every time.