Openmarkets take security seriously. We have therefore implemented Multi-Factor-Authentication (MFA). This helps keep your information secure. MFA is being rolled out across our products, and products that use the Openmarkets identity provider.
What is MFA?
Multi-factor authentication (MFA) is an important security measure used by Openmarkets to protect sensitive information and prevent unauthorised access to our systems and data.
MFA works by requiring users to provide two or more pieces of evidence to verify their identity when logging into our systems.
-
The first piece of evidence is your username and password, like you’ve always done.
-
The second, new, piece of evidence is a number that’s displayed on a device you own
Why are we implementing MFA?
By requiring multiple forms of authentication, MFA significantly reduces the risk of a security breach caused by stolen or weak passwords. Even if an attacker manages to obtain a user's password, they would still need access to the second factor of authentication in order to gain access to our systems.
At Openmarkets, we take security very seriously, and we recognise that passwords alone are not enough to protect against today's sophisticated cyber threats. That's why we have implemented MFA as a standard security measure across all of our systems and applications.
We also require that our employees use MFA whenever accessing systems containing company or client data, as it can help protect against identity theft and other forms of cybercrime.
Install an Authenticator App on your device
If you already have an Authenticator app setup on your portable device or computer, read our Setting up MFA guide. If not, here are some of our favourites:
| IOS | Android | Mac | Win | Linux | ||
| Authy is free and known for its user-friendly interface and the ability to back up your authentication codes. This is helpful in case you change or lose your device. | ||||||
| Lastpass - If you use the LastPass password manager, their free authenticator app is a good choice. It offers seamless integration with the LastPass manager and secure backup for your configuration. | ||||||
| 1Password - If you use 1Password as your password manager, their authenticator feature can be handy. It keeps your passwords and MFA codes in one secure place. | ||||||
| Google Authenticator is free and one of the most popular and widely used authenticator apps. It's easy to set up and can be used for various online accounts | ||||||
| Microsoft Authenticator - If you're in the Microsoft ecosystem, this app works well. It not only generates TOTPs but also supports push notifications for quick and easy authentication. | ||||||
| BYO - If you prefer another Authenticator app, we support them all. The above list are just a few we like. |
Remember, the effectiveness of an authenticator app isn't just about the app itself; it's also about how securely you use it. Make sure your device is protected with a strong PIN, password, or biometric lock. Also, consider enabling any available security features for the authenticator app itself, such as biometric access.
Frequently Asked Questions
Q: Do I need to enter an MFA code every single time I log in?
A: When you log in on a device, you can choose to “Remember this device”. This will allow you to login using just your username and password for the next 15 days. If you log in using a different device (or even a different browser on the same device) you will need to enter the MFA code again. Ensure you never use this option when you’re using a shared device
Q: What if I lose my MFA device or can't use it?
A: When you set up Openmarkets MFA, you were provided with a list of recovery codes. When you come to the MFA page at login, select ‘log in with a recovery code’ and enter one of your codes. Note: These codes are one-time use only. Make sure to record these codes during the initial setup to avoid getting locked out.
Q: What is a recovery code and when do I use it?
A: When you configure MFA, you will be provided with ten recovery codes. You should save and keep these handy for future use as needed. Recovery codes can be used in place of your normal authenticator code once you have provided valid login credentials.
These recovery codes cannot be retrieved after they are displayed when setting up your multi-factor authentication, and each is only valid for one login.
Q: What happens if I lose my recovery codes?
A: If you have lost your recovery codes but are still able to log in, then visit the security settings page and choose “reset recovery codes” to retrieve a new set of 10 codes.
If at any time you choose to reset your authenticator, a new set of 10 recovery codes will be provided - remember to save them.
If you have lost your recovery codes but cannot log in, you’ll need to contact us.
Q: How do I store my recovery code?
A: We recommend storing your recovery codes inside your password manager. If you are not using a password manager, you can consider storing the codes on a piece of paper kept in a safe place, or in a document in secure cloud storage such as Google Drive, OneDrive or Dropbox.
Q: How often do I need to authenticate my browser?
A: Once you have logged in, your session will be logged out after 30 minutes of inactivity. If you checked 'Remember this device" when logging in, you won't need to re-do MFA until after 15 days.
Q: Is MFA really necessary for me?
A: Absolutely. MFA adds a strong layer of protection against hacking and unauthorised access. It's a small inconvenience that can prevent a lot of trouble down the road.
Q: Can I use MFA on multiple devices?
A: Yes, many MFA authenticator apps allow you to set up multiple devices for authentication, like your smartphone and a backup device, to ensure you're not locked out if one device is unavailable. Check out the documentation for your chosen Authenticator app.
Q: Can I turn off MFA if I don't like it?
A: Due to the sensitivity of data, and the implications of an account being hacked, most Openmarkets products require MFA, as it significantly boosts security.
Note: Depending on the account type, and what is available on the account, not all products are required to have MFA enabled. If you don’t get asked to set up Multi-Factor authentication, then it’s not enabled on your account. If this is the case, and you feel it should be, please contact support.
Q: Are there any additional costs to having MFA on my account?
A: No. We’re committed to protecting your account with the best security available. However, you may choose to use a paid Authenticator app on your phone or computer, instead of a freely available one such as Authy. This is entirely your choice.
Remember, MFA might feel a bit like extra steps, but those steps are what keep your digital world safe and sound. So, embrace the MFA, and rest easy knowing you're taking a big step towards keeping your data secure.