Account security

#Overview

This page explains how to protect your Yeap Cloud account: choosing a strong password, resetting a forgotten password, turning on two-factor authentication (2FA), and reviewing recent account activity. Security settings are under 个人设置 > 安全设置 (Settings > Security) at /settings.

#Password requirements

Whenever you register, change or reset a password, the new password must:

• be at least 8 characters long;
• contain both letters and digits.

We recommend a long random password from a password manager that you don't reuse on other sites.

#Change your password

1. Open 个人设置 (Settings) and go to the 安全设置 (Security) tab.
2. Under 修改密码 (Change password), enter your current password, the new password, and the new password again to confirm.
3. Submit. The new password takes effect immediately; use it the next time you sign in.

If the current password is wrong, you'll see "Current password is incorrect".

#Reset a forgotten password

If you have forgotten your password, you can reset it through your registered email address:

1. On the sign-in page, click 忘记密码? (Forgot password?) to open the 重置密码 (Reset password) page (/reset-password).
2. Enter your account's email address, submit, and complete the human-verification challenge.
3. You'll see the same message whether or not the address is registered, so nobody can use this page to find out which accounts exist. If the address belongs to an active account, we send you an email with a reset link.
4. Open the link in the email. It is valid for 1 hour and works only once. Enter and confirm your new password, complete the human-verification challenge, and submit.
5. Once you see the success message, sign in with your new password.

#Email verification

If we sent you a verification email after you registered, open the link in it within 24 hours. Your account is activated once the address is verified. If you try to sign in before verifying, the sign-in page shows an "email not verified" notice with a 重发验证邮件 (Resend verification email) button.

If the sign-up page told you your account is awaiting administrator review, your account is activated by manual review instead and no email verification is needed. You can sign in once it has been approved.

You can change your account email under 个人设置 > 个人资料 (Settings > Profile). The new address must not already be used by another account. Make sure the address can receive mail so that you get password-reset emails.

#Two-factor authentication (2FA)

With 2FA on, signing in requires a 6-digit one-time code from an authenticator app in addition to your password. Yeap Cloud uses the standard TOTP algorithm, so it works with any TOTP authenticator, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.

#Turn on 2FA

1. Go to 个人设置 > 安全设置 (Settings > Security). In the 两步验证 (2FA) section, click 设置两步验证 (Set up two-factor authentication).

2. Scan the QR code in the dialog with your authenticator app. If you can't scan it, copy the secret key shown below the code and add it manually.

3. Enter the 6-digit code your app shows to confirm.

   Note

   You have 10 minutes from clicking "Set up" to confirm the code. After that, start the setup again.

4. When 2FA is on, the dialog shows 8 backup codes. Copy them straight away and keep them somewhere safe, such as your password manager.

Once enabled, the 两步验证 (2FA) section shows "已启用 (Enabled)" and the number of backup codes you have left.

#Sign in with 2FA

1. On the sign-in page, enter your username and password and complete the human-verification challenge.
2. On the code step, enter the current 6-digit code from your authenticator app and click 验证并登录 (Verify and sign in).
3. If you don't have your phone, click 使用备用码 (Use a backup code) and enter one of your 10-character backup codes. That code is then used up.

The sign-in challenge expires after 5 minutes and allows up to 5 attempts. After that, click 返回登录 (Back to sign in) and enter your password again.

#Turn off 2FA

1. Go to 个人设置 > 安全设置 (Settings > Security) and click 停用两步验证 (Disable two-factor authentication).
2. Enter your 账户密码 (account password) and a 验证码 / 备用码 (code or backup code): either the 6-digit code from your app or one backup code.
3. Confirm. 2FA is turned off and any remaining backup codes stop working.

#Running out of backup codes

Backup codes can't be regenerated on their own at the moment. If you're running low, turn 2FA off and on again to get a fresh set of 8 codes. You'll also need to add the account to your authenticator app again.

#Recent activity

The 最近动态 (Recent activity) card on the dashboard shows the latest 5 security-related events on your account, each with a description, time and source IP address. For example:

• successful and failed sign-ins (wrong password or wrong 2FA code);
• password changes and password resets by email;
• 2FA turned on or off;
• email verification completed.

If you see activity you don't recognize, change your password straight away and turn on 2FA.

#Sign out

Click your avatar in the top-right corner and choose 退出登录 (Sign out). Signing out invalidates your current session and also revokes any "Remember me" sessions. On a public or shared computer, always sign out before you leave, and don't tick "Remember me".