Prevent Account Takeovers with Two-Factor Authentication and Login Protection

Your SNS TOWN login is also the key to your official accounts

When you connect a social account to SNS TOWN, SNS TOWN holds the permission to post to that account. It does not hold the account's password, but anyone who can log in to SNS TOWN can post to or delete from the connected accounts. In other words, if a SNS TOWN login is broken into, it is close to having your official account taken over.

Reused passwords, phishing emails and logins left on shared PCs are all ordinary ways takeovers begin. SNS TOWN gives every user, on every plan, protection at the door that doesn't rely on a password alone.

Common takeover methods and countermeasures are covered in Protecting Official Accounts from Takeovers.

The settings screen is "Account & sign-in" in the person menu in the header.

Two-factor authentication: a leaked password isn't enough

With two-factor authentication on, you enter a 6-digit code from an authenticator app on your phone in addition to your password when you log in. Google Authenticator, Microsoft Authenticator, 1Password and other common apps whose codes change every 30 seconds will work. Even if your password leaks, no one can log in without that phone. The term is explained in Two-Factor Authentication.

Setup takes three steps.

1. Install an authenticator app on your phone.
2. Scan the QR code on the screen with the app. If it can't be read, type in the key shown below it.
3. Enter the 6-digit code shown in the app and click "Turn on".

Right after you turn it on, 10 recovery codes are shown. You can use them one at a time in place of the 6-digit code if you lose your phone. This screen never appears again, so print the codes or save them in a password manager. When few remain, you can generate new ones by entering your password. Generating new ones invalidates all the old codes.

A 6-digit code that has been used once can't be used again. When logging in, you have 10 minutes and 5 attempts to enter the code. If it keeps failing, you start over from the beginning.

Require it for everyone in a company or brand

In a company or brand's "Security" screen, an admin can require two-factor authentication for all members. Once it's on, members who haven't set it up are sent to the account screen when they try to open that company or brand, and can't get in until they do. People who belong to a company or brand that requires it can't turn off their own two-factor authentication. It is especially reassuring when you share operations with outside people. To invite members, see Members and Roles.

Lockout after repeated failures

If login fails 5 times in 15 minutes for the same email address, or 20 times in 15 minutes from the same IP address, SNS TOWN stops accepting logins for a while. During the lockout, it doesn't even check a correct password. The point is to stop password-guessing attacks on the spot.

If you get locked out yourself, wait about 15 minutes or reset your password. The login and sign-up screens also include a check that a person is operating them.

Changing and resetting your password

On the account screen, enter your current password to change it. Passwords must be at least 8 characters. After you change it, every login except the device you are using is signed out.

If you forget your password, you get a reset link by email from the login screen. The link is valid for 1 hour and works once, and once you set a new password, every device is signed out. If you enter an email address that isn't registered, the screen looks the same, so no one can probe who has an account.

Signed-in devices and the sign-in history

"Signed-in devices" on the account screen lists the devices logged in right now. It shows the device name such as "Windows · Chrome", the IP address, when it logged in and when it was last used. If you don't recognize one, click "Sign out" to end it, or click "Sign out all other devices" to end them all at once. This is also useful if you forgot to log out on a shared PC.

Logins expire after 30 days, and even within that time, after 14 days of not being used. This keeps logins from lingering on long-neglected devices.

"Sign-in history" keeps the latest 20 records of successful and failed logins, lockouts and resets. If a login comes from both a device and an IP address we haven't seen before, we let you know by email. If it wasn't you, change your password right away.

Keeping out AI and automation tools

The logged-in screens don't admit AI crawlers, AI agents, headless browsers, scripts or other automated access. Anything that can be identified as not being a person's browser, from how it names itself or how it communicates, is refused on the spot. This protection is always on and users can't remove it. The aim is to keep automated tools from touching the posting permissions we hold.

Combining it with other protections

Login protection locks down who can get in. To narrow down where they can get in from, combine it with Access Restriction, which allows access only from approved IP addresses and devices for each company or brand. Dividing up what each member can do by role also keeps the impact small in an emergency. The overall approach to protection across SNS TOWN is summarized in Security.

Frequently asked questions