Security keys
A Markleex account can be guarded by a security key: a piece of hardware you touch to sign in. It cannot be read over your shoulder, it cannot be copied out of a database, and it refuses to answer a site that is not this one, which is what a code typed into the wrong page cannot do.
What works
Markleex speaks WebAuthn, the standard behind security keys, so any key that follows it is welcome:
- A USB or NFC key, such as a YubiKey. You plug it in and touch it, or hold it to the back of your phone.
- The one built into your device: Touch ID, Face ID, Windows Hello, or your Android phone.
It works in any recent browser over a secure connection: Chrome, Safari, Firefox and Edge, on Windows, macOS, Linux, iOS and Android. Markleex asks the key for nothing but a signature: it does not ask it for a PIN, and it does not take up one of the slots a key keeps for the accounts it remembers.
Add one
- Sign in at markleex.com and open Security from the account menu.
- Under Security keys, give the key a name, so you know which one it is later.
- Select Add a security key, then plug the key in and touch it, or hold it to your phone.
- Write down the 10 recovery codes Markleex hands you, and keep them away from the key.
From then on, signing in asks for your password and then for your key. Touch it, and you are in.
Keep a spare
You can add as many keys as you hold, and this is what the second one is for: a key stays at the office, travels in a pocket, or breaks. Register two, keep them in different places, and either one opens your account.
If a key is gone
Each recovery code signs you in once, without your key and without your phone. Sign in with one, remove the key you lost, and add its replacement. New codes are yours for the asking, and making new ones replaces all of them at once.
Manage them
The Security screen lists every key on your account, with the day you added it and the day it last opened your account. From there you can rename one, which is how you tell two keys apart, and remove one, which asks for your password.
A security key sits alongside an authenticator app rather than instead of it: you can hold both, and removing one leaves the other guarding your account. Markleex keeps no secret of yours here, only a public key, so what is stored opens nothing on its own.