Two-Factor Authentication (2FA)

Learn how to use Mixin Messenger's built-in two-factor authentication to protect your account and asset security.

What is Two-Factor Authentication

Two-Factor Authentication (2FA) is a security mechanism that provides an additional layer of protection for your account.

Authentication Factors

First Factor: Something You Know

• PIN code
• Password
• Mnemonic phrase

Second Factor: Something You Have

• Mobile device
• Biometrics
• 2FA verification code

Mixin's 2FA Features

Feature	Description
Built-in 2FA	No third-party app needed
Decentralized	Based on MPC technology
Every Transaction	Transfers must be verified
Biometrics	Supports fingerprint/face
Backup Recovery	Multiple recovery methods
Open-Source Transparency	Code auditable

Set Up Two-Factor Authentication

During Account Creation

Automatically Enabled:

1. Generate Mnemonic Phrase

   • Generate 12 words when creating account
   • Mnemonic phrase is first line of defense
   • Secure backup is crucial

2. Set PIN Code

   • Create 6-digit PIN
   • For daily verification
   • Is second line of defense

3. Biometrics (Optional)

   • Set up fingerprint/face recognition
   • Quick and secure
   • Enhances user experience

Enable Biometrics

Setup Steps:

1. Go to "Settings" → "Security"
2. Select "Biometric Authentication"
3. Enter PIN code to verify
4. Record fingerprint or face
5. Test verification
6. Complete setup

Supported Biometrics:

• 📱 Face ID (iOS)
• 📱 Touch ID (iOS)
• 🤖 Fingerprint (Android)
• 🤖 Face Recognition (Android)

PIN Code Management

Set Secure PIN:

✅ Recommended Practices:

• Use random number combinations
• Avoid birthdays, phone numbers
• Don't use same as other apps
• Change regularly

❌ Avoid:

• 123456, 000000 etc simple combinations
• Repeated digits (like 111111)
• Sequential numbers (like 123456)
• Personal information related numbers

Change PIN Code:

1. Settings → Security → Change PIN
2. Enter current PIN
3. Enter new PIN (6 digits)
4. Confirm new PIN
5. Complete change

Forgot PIN Code:

• Recover account using mnemonic phrase
• Reset new PIN
• Assets not affected
• See Wallet Recovery

2FA Usage Scenarios

Asset Transfers

Each Transfer Requires:

1. Enter PIN Code

   • Confirm transfer amount
   • Enter 6-digit PIN
   • Or use biometrics
   • Must verify to send

2. MPC Signing

   • Automatically in background
   • Multi-party computation verification
   • Decentralized protection
   • No extra operation needed

Transfer Process:

Initiate transfer
  ↓
Enter amount and address
  ↓
Confirm transaction info
  ↓
PIN code verification (2FA)
  ↓
Biometric verification (optional)
  ↓
MPC multi-signature confirmation
  ↓
Transaction sent
  ↓
Blockchain confirmation

Sensitive Operations

Operations Requiring 2FA:

1. Account Settings

   • Export mnemonic phrase
   • Change PIN code
   • Set social recovery
   • Delete account

2. Asset Management

   • Withdraw to external address
   • Add new address
   • Large transfers
   • Wallet settings

3. Security Settings

   • Modify security settings
   • View private keys
   • Log out all devices
   • Reset 2FA

Login Verification

New Device Login:

1. Enter mnemonic phrase
2. Set new PIN code
3. Optionally enable biometrics
4. Verify account access

Multi-Device Management:

• Each device independent PIN
• Biometrics separately set
• One device verification doesn't affect others
• Can remotely log out devices

Advanced Security Features

TIP (Transaction in PIN)

What is TIP:

• Mixin's innovative 2FA solution
• Decentralized authentication based on MPC
• PIN is transaction password
• No extra authenticator needed

TIP Advantages:

• Decentralized, no single point of failure
• No dependency on third parties
• Deeply integrated with transactions
• Higher security

Technical Principle:

User PIN
  ↓
Local encryption processing
  ↓
Generate key shards
  ↓
Distributed MPC nodes
  ↓
Multi-party computation verification
  ↓
Reach consensus
  ↓
Authorize transaction

Multi-Signature

MPC Multi-Signature Mechanism:

1. Key Sharding

   • Private key split into multiple fragments
   • Distributed across different nodes
   • Single fragment cannot be used
   • Need majority fragments to sign

2. Signing Process

   • Initiate transaction request
   • Each node calculates independently
   • Don't leak key fragments
   • Compose final signature

3. Security Guarantee

   • Some node failures don't affect
   • Prevent single point attacks
   • Decentralized architecture
   • Military-grade security

Time Lock

Delayed Withdrawal:

1. Set Time Lock

   • Settings → Security → Time Lock
   • Select delay time (1-24 hours)
   • Large withdrawals auto-delayed
   • Can cancel in emergency

2. How It Works

   • Enter waiting period after initiating withdrawal
   • Can cancel during waiting period
   • Auto execute when time expires
   • Prevent theft attacks

3. Use Cases

   • Large asset protection
   • Prevent immediate transfer after phone stolen
   • Leave reaction time
   • Add security buffer

Account Protection

Mnemonic Phrase Security

Best Practices:

1. Physical Backup

   • Write by hand on paper
   • Use metal plates
   • Multiple backups
   • Store in different locations

2. Storage Locations

   • Home safe
   • Bank safe deposit box
   • With trusted family
   • Professional storage service

3. Strict Confidentiality

   • Don't photograph
   • Don't screenshot
   • Don't cloud store
   • Don't send to anyone

❌ Never:

• Store on computer/phone
• Send to others
• Store online
• Share with others
• Enter on phishing sites

Device Security

Lock Screen Protection:

1. Set Device Password

   • Strong password or biometrics
   • Auto lock screen
   • Set lock time
   • Failure attempt limits

2. App Lock

   • Mixin app lock
   • Extra protection layer
   • Verify to open app
   • Set timeout

Remote Protection:

• Enable "Find My Device"
• Can remotely lock
• Can remotely wipe
• Prevent data leaks

Network Security

Secure Connection:

1. Avoid Public Wi-Fi

   • Don't transfer on public Wi-Fi
   • Use cellular data
   • Or use VPN
   • Prevent man-in-the-middle attacks

2. Check Network

   • Confirm HTTPS connection
   • Verify certificate
   • Watch for phishing sites
   • Use official apps

Social Recovery

Set Up Social Recovery

As 2FA Backup:

1. Choose Recovery Contacts

   • Select 3-5 trusted friends
   • They are your backup
   • Can recover if PIN lost
   • Distributed security mechanism

2. Recovery Process

   • Initiate recovery request
   • Contact recovery contacts
   • Majority agree
   • Reset PIN and 2FA

See detailed info: Social Recovery Guide

Recovery Contact Responsibilities

As Recovery Contact:

1. Duties

   • Safely store key shard
   • Verify recovery requests
   • Confirm identity
   • Respond promptly

2. Considerations

   • Confirm through other means
   • Don't easily agree
   • Keep Mixin active
   • Inform others of changes

Security Checklist

Daily Checks

Weekly Check:

• ✅ Check logged-in device list
• ✅ Review recent transactions
• ✅ Confirm social recovery contacts
• ✅ Test biometric function

Monthly Check:

• ✅ Update app to latest version
• ✅ Check security settings
• ✅ Review account activity
• ✅ Verify backup integrity

Quarterly Check:

• ✅ Change PIN code
• ✅ Test recovery process
• ✅ Update recovery contacts
• ✅ Check mnemonic phrase backup

Security Score

Self-Assessment:

1. Basic Security (Must)

   • ✅ Backup mnemonic phrase
   • ✅ Set strong PIN
   • ✅ Enable biometrics
   • ✅ Device password protection

2. Advanced Security (Recommended)

   • ✅ Set social recovery
   • ✅ Enable time lock
   • ✅ Regularly change PIN
   • ✅ Multiple mnemonic backups

3. Expert Security (Optional)

   • ✅ Use hardware wallet
   • ✅ Cold storage large amounts
   • ✅ Professional mnemonic storage
   • ✅ Regular security audits

Emergency Response

Device Lost

Immediate Actions:

1. Login on New Device

   • Recover using mnemonic phrase
   • Immediately change PIN
   • Check transaction records
   • Check for abnormal activity

2. Remote Protection

   • Log out all devices
   • Modify important settings
   • Transfer assets if needed
   • Notify contacts

PIN Code Leaked

If PIN Suspected Leaked:

1. Immediately Change

   • Settings → Change PIN
   • Use completely new combination
   • Enable time lock
   • Monitor account activity

2. Extra Measures

   • Check transaction history
   • Review device list
   • Strengthen other security
   • Transfer assets if necessary

Mnemonic Phrase Leaked

Highly Dangerous, Immediate Action:

1. Create New Account

   • Immediately create new account
   • Generate new mnemonic phrase
   • Set new PIN

2. Transfer Assets

   • Transfer all assets ASAP
   • Prioritize large amounts
   • Notify contacts
   • Update wallet addresses

Best Practices

Security Recommendations

Basic Principles:

1. Never Share

   • Mnemonic phrase
   • PIN code
   • Private keys
   • Verification codes

2. Stay Vigilant

   • Identify phishing attacks
   • Verify website authenticity
   • Don't click suspicious links
   • Don't install suspicious apps

3. Regular Maintenance

   • Update apps
   • Check settings
   • Backup data
   • Test recovery

Transaction Security

Pre-Transfer Checklist:

1. Carefully Verify

   • Receiving address
   • Transfer amount
   • Token type
   • Network/chain

2. Small Amount Test

   • Test large transfers first
   • Confirm arrival
   • Then transfer large amount
   • Avoid losses

3. Double Confirm

   • Check address multiple times
   • Confirm recipient
   • Check notes
   • Operate carefully

Common Questions

Does 2FA make it harder to use?

No:

• Biometrics very convenient
• PIN quick to enter
• Only needed at critical times
• Worth the security

What if I forget PIN?

Two ways:

• Recover using mnemonic phrase
• Through social recovery
• Reset PIN
• Assets won't be lost

Are biometrics secure?

Very secure:

• Stored locally
• Not uploaded
• Hardware encryption
• Cannot copy

Can I disable 2FA?

No:

• 2FA is mandatory
• Protects asset security
• Cannot disable
• But can choose verification method

How does multi-device 2FA work?

Independent setup:

• Each device independent PIN
• Biometrics separately set
• One verification doesn't affect others
• Flexible and convenient

Is social recovery secure?

Very secure:

• Needs multiple people to agree
• Has time delay
• Can refuse anytime
• Distributed protection

Will time lock affect normal use?

No:

• Only affects large withdrawals
• Normal transfers unaffected
• Can customize threshold
• Can cancel in emergency

Technical Details

MPC Technology

Multi-Party Computation Principle:

Key Sharding
├─ Node 1 (33% key)
├─ Node 2 (33% key)
└─ Node 3 (33% key)

Signing Process:
1. User initiates transaction
2. PIN verification
3. Each node calculates independently
4. Don't expose key fragments
5. Compose complete signature
6. Transaction authorized

Security Advantages:

• No single point of failure
• Key never aggregated
• Distributed security
• Quantum resistance

TIP Protocol

Transaction in PIN:

• Decentralized 2FA
• PIN is key
• MPC implementation
• No third-party authenticator needed

Comparison with Traditional 2FA:

Feature	TIP	Traditional 2FA
Decentralized	✅	❌
No Single Point Failure	✅	❌
Deep Integration	✅	🔸
User Experience	✅	🔸
Security	Highest	High

Related Resources

• Create Account - Learn about mnemonic and PIN
• Wallet Recovery - Recover account access
• Social Recovery - Set up social recovery
• Privacy Protection - Comprehensive security guide
• MPC Wallet - Learn MPC technology