Two-step sign-in means a stolen password alone can't get anyone into your account. After your password, you enter a 6-digit code.
Who has it. Every account created since two-step sign-in launched has it from the start — your first code also confirms your e-mail address. Accounts from before can turn it on at /admin/account/security (you'll be asked once, at the top of the console).
Codes by e-mail. The code arrives at your account's address, works once, for 10 minutes. "Send a new code" works every 30 seconds, up to 5 codes per sign-in. Each code allows 5 tries; 10 wrong codes in a row pause codes for your account for 15 minutes.
Authenticator app. At /admin/account/security, choose "Use an authenticator app", enter your password, scan the QR code with Google Authenticator, Microsoft Authenticator, 1Password, Authy or similar, and enter the first code. From then on, codes come from the app, not e-mail. You'll get 10 backup codes — save them somewhere safe; each works once if you lose your phone.
Remember this device. Tick it when you enter a code, and that browser skips the code for 30 days. We e-mail you when a device is remembered. Forget one device, or all of them, at /admin/account/security. Only tick it on a computer you alone use.
Sign-in links. An account with two-step sign-in signs in with its password and a code; an e-mailed sign-in link on its own isn't enough.
Lost your phone and your backup codes? Write to support@offerrole.com from your account's address. Once we've confirmed it's you, we reset two-step sign-in: the app, backup codes and remembered devices are removed, and codes come by e-mail again. We'll never ask you for a code by phone, e-mail or chat.
Changing any of this asks for your password, and every change is e-mailed to you.
Posting and reviewing are free. Every stage, e-mail and export described here is in the console from the first sign-in.