Two-factor authentication and recovery codes

It’s already on

Every Bighound account requires an authenticator app. There’s no setting to disable it and no “remind me later”.

That’s not us being difficult. Your Bighound account contains your household’s names, addresses, ages, phone numbers and email addresses in one place — a tidier package than most of the brokers hold. An account like that protected by a password alone is an unlocked filing cabinet.

For contrast: a well-known paid competitor’s account page shows Password: No password and 2-step verification: Inactive by default, on an account holding the same kind of file.

Recovery codes are not optional in practice

Generate them. Today. Account page → Recovery codes.

Because 2FA is mandatory and your data is encrypted with a key that’s useless without you, there is no support override. If you lose your phone with no recovery codes, we cannot get you back in. Not “it’s a hassle” — we genuinely cannot. We can’t read your data either.

You get ten single-use codes, shown exactly once. We store only a one-way hash, so we can’t show them again even if you ask.

Put them somewhere that survives losing your phone: a password manager, or printed and filed with your passport.

Using one

On the sign-in screen, choose Lost your authenticator? and enter a code instead of the six-digit number. Each works once. When you’re down to two, the account page starts nagging — generate a fresh set, which invalidates the old ones.

If you think someone has your codes

Generate a new set immediately. That invalidates every previous code. Then change your password, which also signs out every other device.