Security guide
Signing in and two-factor authentication
Your account controls your public listing, so it's worth protecting. This guide covers signing in, using shared computers, and adding an authenticator app so a password alone isn't enough to get in.
The short version
Sign in once on shared computers
"Sign in once" doesn't keep you signed in after you close the browser.
Add a second factor
An authenticator app stops anyone who learns your password from signing in.
Keep your recovery codes
They're shown once. Without them, a lost phone can lock you out of your account.
Signing in
Email links and passwords
You don't need an account to search The Roll. You need one to list or manage a practice.
Your first sign-in
You choose a password when you sign up, and we email you a link. Open it and enter your password to confirm your email and sign in. Links work for 15 minutes and only once; ask for a new one from the sign-in page.
Forgot the password you chose?
The confirmation page lets you confirm without it. The password is removed, and you can set a new one in your account settings.
Forgot your password?
Choose "Forgot your password?" on the sign-in page and we'll email you a link to choose a new one. It works for 15 minutes and only once. Resetting signs you out everywhere; two-factor authentication stays on.
Sign in, or sign in once
Sign in keeps you signed in on that device. Sign in once ends when you close the browser; use it on shared or public computers.
Too many attempts
After several wrong passwords, sign-in pauses for a while. Wait, then try again.
Changing your email
Change it in your account settings. We send a confirmation link to the new address, which works for seven days.
Two-factor authentication
Set up an authenticator app in four steps.
Once it's on, every sign-in asks for a six-digit code from your phone, including sign-ins from an emailed link. Any standard authenticator app works.
-
Step 1
Open your settings
Go to Account settings, choose Manage two-factor authentication, then Set up authenticator.
-
Step 2
Scan the code
Scan the QR code with your authenticator app, or type in the secret shown beneath it.
-
Step 3
Enter a code
Enter the six-digit code your app shows. Setup that isn't finished within ten minutes expires, and nothing changes.
-
Step 4
Save your recovery codes
Before leaving the page, save the ten recovery codes. They're shown only this once and are never emailed.
Recovery codes
Your way back in
Recovery codes are the only way to sign in if you lose your phone, so treat them like a spare key.
Using them
One code, one sign-in
- Enter a recovery code instead of an authenticator code at the sign-in screen.
- Each code works once. Spaces and lowercase letters are fine.
- Generate a fresh set from your settings whenever you're running low.
Storing them
Away from your phone
- Keep them in a password manager or printed somewhere safe.
- Not on the same phone as your authenticator app.
- If you lose both your phone and your codes, The Roll can't currently restore access by email.
Changing settings
Protecting the protection
Recent sign-in required
Turning two-factor off, moving to a new authenticator or generating new recovery codes needs a sign-in within the last ten minutes and a current code.
Other sessions are signed out
Each of those changes signs out your other browsers and devices, so anyone else who was signed in has to sign in again.
Replacing a phone
Your old authenticator keeps working until the new one is set up, so you aren't locked out halfway through.
Wrong codes
Ten wrong codes in ten minutes pause further attempts until the ten minutes are up.
Common questions
Questions people ask
Do I need an account to search The Roll?
No. Anyone can search the directory and read profiles and the Journal. You need an account only to list or manage a practice.
Which authenticator apps work?
Any app that shows six-digit time-based codes, such as the authenticator apps built into many password managers.
My code didn't work. What should I do?
Check that your phone's clock is set automatically, and wait for a fresh code. A code that has just been used can't be used again.
I lost my phone. How do I sign in?
Use one of your recovery codes instead of an authenticator code, then set up your new phone from your settings. Without a recovery code, The Roll can't currently restore access by email.
Turn on two-factor authentication.
It takes a minute. Have your phone ready, and somewhere safe to keep your recovery codes.