What is two factor authentication for signing?

The three categories, briefly

Authentication factors are traditionally grouped as something you know, something you have and something you are. A password or a shared code is knowledge. A phone, a mailbox or a hardware key is possession. A fingerprint or a face is inherence. Two factor means drawing from two different groups, which is why two passwords are not two factors and why an emailed code following an emailed link is a weaker arrangement than it appears. The grouping is a rule of thumb rather than a law, but it catches the common design mistake.

Independence is the whole point

The reason for a second factor is to ensure that one compromise is not enough. Judge any pair by asking what a single successful attack would obtain. Mailbox access alone yields both the link and any code sent to that address, so the pair collapses to one factor. Mailbox access plus a code passed over the phone requires the attacker to intercept two channels, which is a materially harder problem. That question is more useful than counting steps, and it is the one vendors rarely answer directly.

Why signing is a slightly different problem

Most authentication protects an ongoing account, so a compromise can be detected and reversed. Signing is a single irreversible act by somebody who often has no account at all and may never return. There is no password to reset and no login history to review. That pushes the design toward checks that happen at the moment of signing rather than earlier, and toward evidence that is recorded permanently, because the value of the check lies in what it can prove months later rather than in what it prevents today.

The friction budget

Every additional step loses a percentage of signers, and the ones lost are disproportionately those least comfortable with technology. That is a real cost, not merely an inconvenience, particularly for consumer facing documents where an abandoned signature means an abandoned transaction. The sensible approach spends the budget where the risk sits: strong checks on high value or high dispute documents and unknown counterparties, and a plain personal link for routine paperwork with people you deal with weekly.

What the record should show

Whatever pair is used, the evidence should name it per signer and per event, with times and addresses, so a reader can see that the second factor was applied at signing rather than assumed. A record that says verified without saying how is close to useless in a dispute. The detailed comparison of the two code based options offered here, including when each is the better choice, is covered on the page comparing access codes and one time codes.

What is available in this product

The pairs that can be assembled are the personal link on its own, the link plus an access code of at least four characters that the sender shares out of band, or the link plus an emailed six digit code valid for ten minutes. The access code pair is genuinely two channel when the code travels by phone or in person. The emailed code pair is not independent, though it does prove mailbox control at signing time. Authenticator apps, text messages and biometrics are not offered. Two operational details decide whether the pairing works in practice. The first is how the access code reaches the signer, which should be a channel the sender already uses with them, such as a phone call to a number on file, rather than the same email thread carrying the invitation. The second is the recovery path when something goes wrong, since five failed attempts lock the recipient for fifteen minutes and a signer under time pressure will ask somebody to read the code out. Deciding in advance who is allowed to do that, and confirming who they are speaking to first, is the part most teams never write down until it goes wrong once.

Questions people ask