Registering FIDO2 security keys

A FIDO2 security key is a small hardware device that holds a private key and signs a challenge from the website when you sign in. ITProMail supports FIDO2 (WebAuthn) keys as a second factor for the webmail login. Because the key signs only for the origin it was registered with, a login page on a look-alike domain cannot use it. That makes FIDO2 more resistant to phishing than a six-digit code, which can be typed into the wrong page.

What you need

• One or more FIDO2-compatible security keys with USB-A, USB-C or NFC connections, as your devices require.
• A current browser with WebAuthn support, such as a recent release of Chrome, Firefox, Safari or Edge.

Register a key

1. Sign in to the webmail at https://itpromail.com/login/.
2. Open Account, then Security.
3. Find the section for security keys and choose the option to add one.
4. When the browser prompts you, insert the key or hold it near the reader, then touch its button or sensor to confirm.
5. Give the key a name that identifies it, such as "Primary key" or "Backup key, safe deposit box". Save the registration.

Register two keys

Register at least two keys. A single key is a single point of failure: if it is lost, damaged or left at the wrong location, the second factor is gone. With two registered keys, either one signs you in. Keep the second key somewhere physically separate from the first, such as a different bag or a secure location at home or at work.

Register both keys in the same session, while you are signed in, so that neither depends on the other for access. Give them distinct names so you can tell them apart when you review the list.

Test both keys

After registering, sign out and sign in with the primary key. Then sign out and sign in with the backup key. Do this before you rely on either key. A key that registered without error but does not sign in should be removed and re-registered.

Fallbacks

Keep a fallback second factor enabled alongside your keys. TOTP with stored backup codes is the usual choice; see enabling TOTP. A fallback matters most if both keys are lost at the same time, for example in a fire or a burglary. Store fallback codes separately from the keys themselves.

Lost or retired keys

If a key is lost, sign in with another registered factor, open Account, then Security, and remove the lost key from the list. Revoke any app passwords or active sessions you do not recognize from the same page, and change your password if you suspect the account was accessed. If you cannot sign in with any factor, follow the process in account recovery.

What a key does not cover

A security key protects the webmail sign-in. Mail clients such as Thunderbird, Apple Mail and aerc do not use hardware keys. They authenticate with app passwords, which you create under Account, then Security and can revoke individually. A key does not protect mail after it has been downloaded to a device, so keep device encryption and screen locks enabled.

For a wider set of account hardening steps, see the security checklist.