What is Ayam Secure Box?


Two-Step Login, which goes by many different names, is a highly-recommended security practice for securing access to websites and applications. Other names for this practice are Two-Factor Authentication (2FA), 2-Step Verification, and Multi-Factor Authentication. We'll use 2FA for the rest of this guide.

The main premise behind 2FA is that after you enter your password (the first step, method, factor, or evidence in proving your identity), you will be prompted to enter a token generated either by an Authenticator app, a hardware security key (like Yubikey), or sent via SMS (text message) to your phone. These days SMS is considered an unsafe method for sending the 2FA token due to the possibility that mailicious actors could intercept your SMS messages and thus gain access to your 2FA protected accounts. Most banks still use SMS as the 2FA token delivery method and hopefully they will upgrade their security practice soon.

Your <a href="https://ayamsecure.com/services/secrets" target="_blank">Secrets</a> password manager has a built-in Authenticator app that you can use with any website that supports Authenticator apps as a 2FA method. Not all websites support Authenticator apps, but if they do, then you should make use of the Authenticator app in your Secrets password manager.

This article will guide you in setting up Secrets as your Authenticator 2FA method for your Google account and Paypal account. After this, you should be able to set up Secrets as your Authenticator app for other websites, such as social media sites, financial sites, etc.

Enabling 2FA on your accounts at Google, Paypal and others will require you to complete a secondary step (entering the 2FA token generated in Secrets) each time you log in, in addition to your primary login method, which is your account password. When setting up 2FA on your various accounts, remember that it is best practice to set up multiple 2FA methods in case you lose access to one of your 2FA methods. You'll see that Google provides multiple 2FA methods that you can set up but Paypal only provides Authenticator app or the use of a Hardware Security Key, which is a more advanced 2FA method that we will cover in a future article.

### Guide to setting up 2FA on Google & Paypal:

Table of Contents:

- [Step 2: Set up 2FA on your Google account](#step-2-set-up-2fa-on-your-google-account)
- [Step 3: Set up 2FA on your Paypal account](#step-3-set-up-2fa-on-your-paypal-account)

---

### Step 1: Sign in to your Google Account

If you're already signed in to your Google account, like via Gmail, then click on your profile icon on the upper right and select `Manage your Google Account`. Otherwise, follow <a href="https://myaccount.google.com" target="_blank">this link to directly navigate to your Google account management</a>, where we will set up the 2FA methods.

![](/posts/post-140.png#image-center)

2FA set up in Secrets is best done via the Bitwarden Browser Extension apps or Desktop apps.

### Step 2: Set up 2FA on your Google account

From the Google Account page, select `Security` on the left sidebar and then select `2-Step Verification` under "How you sign in to Google".

![](/posts/post-122.png#image-center)

From the page that pops up, select `Get started`.

![](/posts/post-123.png#image-center)

Google first forces you to set up a phone number for SMS as a default 2FA method. So go ahead and do that. Enter your phone number and then enter the 6-digit passcode that Google sends to your phone.

![](/posts/post-124.png#image-center)

If it all looks good, select `Turn on`.

![](/posts/post-125.png#image-center)

And then you'll be back on the `Security` page and you can confirm that you have the default 2FA method set up. Next, we will set up Authenticator app as a 2FA method.

At the bottom of the 2FA section, select the button that says `Authenticator`.

![](/posts/post-126.png#image-center)

You can also navigate to the Authenticator app settings page by clicking once again on the right arrow at `2-Step Verification` and then selecting `Authenticator app`.

![](/posts/post-127.png#image-center)

From the `Authenticator app` page, select `Set up authenticator`.

![](/posts/post-128.png#image-center)

The page will initially only show you a QR code that you can scan with your Secrets mobile app but it's easier to do this with the Browser Extension app. Select `Can't scan it?`.

![](/posts/post-129.png#image-center)

Now you'll be presented with the `secret key` that we will save in our Secrets login entry for this Google account. Copy the string of letters and number in Step 2.

![](/posts/post-130.png#image-center)

Open your Bitwarden Browser Extension App, select the login entry for this Google Account, click on `Edit`, and then in the input box below `Password` labeled `Authenticator key (TOTP)`, paste the string of letters and numbers. This is the `secret key` that Secrets will use to generate unique one-time passcodes (OTP) that will match what your Google account is expecting when it prompts you for the 2FA token.

![](/posts/post-133.png#image-center)

After clicking `Save`, you'll see that the `Verification code` field starts displaying a 6-digit 2FA token (or one-time passcode) that refreshes every 30 seconds. Copy this code and paste it in the Google account pop-up view for setting up your authenticator app and click `Verify`.

![](/posts/post-134.png#image-center)

If it all looks good, you'll now see that you have set up Authenticator as a 2FA method for your Google account.

![](/posts/post-135.png#image-center)

Click the back arrow to come back to the 2-Step Verification page, which should now show you that the more-secure `Authenticator app` has been selected by Google as your default 2FA method with your phone being a backup 2FA method. We should set up one more backup 2FA method, which is generating and saving 2FA backup codes. Click on `Backup codes`.

![](/posts/post-136.png#image-center)

Select `Get backup codes`.

![](/posts/post-137.png#image-center)

And now you'll be presented with 10 one-time use 2FA backup codes. These codes can give access to your account if someone knows your password so guard these backup codes just like they were a password. We recommend saving these backup codes in your Secrets login entry for this Google account and logging in to your Secrets account from multiple devices to avoid getting yourself locked out. You could also print these backup codes and put them in a bank safety deposit box.

![](/posts/post-138.png#image-center)

Back on the `2-Step Verification` page you'll see that you have `Authenticator app` set up as your default 2FA method, then your phone number as your first backup and the 2FA backup codes as a secondary backup. Now this a robust 2FA setup because there are multiple 2FA methods set up on this one account and it is very unlikely that you would be locked out of this account or that a bad actor might gain access to your account.

![](/posts/post-139.png#image-center)

Let's see what a login flow would look like now that you have 2FA set up on your Google account. Sign out or logout of your Google account and then sign in again.

![](/posts/post-141.png#image-center)

Enter your Google account password.

![](/posts/post-142.png#image-center)

Then you will be prompted to enter a `verification code` from your authenticator app, referring to the login entry in Secrets for this Google account.

![](/posts/post-143.png#image-center)

In the Bitwarden Browser Extension App, search for your login entry for this Google account and click on the far right clock icon to copy the verification code or OTP to your clipboard. If you're curious why a clock icon is shown for this 2FA token, it's because this token is a Time-based One Time Passcode that refreshes every 30 seconds.

![](/posts/post-144.png#image-center)

Alternatively, click on the view icon of this login entry and then from the `Verification code` line, click the copy icon on the far right to copy the verification code to your clipboard. It's ok if the timer reaches zero and expires, you have a few seconds to enter the passcode before you'll need to enter a refreshed one.

![](/posts/post-145.png#image-center)

On the Google login vew, paste the `Verification code` and click `Next`.

![](/posts/post-146.png#image-center)

That's it! You've set up Secrets as your Authenticator app for your Google account and now your Google account is better secured from bad actors.

### Step 3: Set up 2FA on your Paypal account

Along with securing your Google account with 2FA, you should also enable 2FA on your financial accounts and other accounts that are important to you or even just any website that offers it as an option. As an example, here are the steps to set up 2FA on your Paypal account.

Login to your <a href="https://www.paypal.com/signin" target="_blank">Paypal account</a>, click the settings icon on the upper right, then select `Security`, and then click on `Set up` to the right of `2-step verification`.

![](/posts/post-113.png#image-center)

Choose `Use an authenticator app`.

![](/posts/post-114.png#image-center)

Below the QR code, copy the `secret key` string of letters and numbers.

![](/posts/post-115.png#image-center)

In your Bitwarden Browser Extension App, find your Paypal login entry, click on `Edit` and in the `Authenticator key (TOTP)` field, paste the `secret key` and click `Save`. Now copy the 6-digit verification code from the Bitwarden app.

![](/posts/post-116.png#image-center)

And paste it in the Paypal prompt and click `Confirm`.

![](/posts/post-117.png#image-center)

If it all looks good, you'll see that `2-step verification` is now turned on in your Paypal account. Paypal currently doesn't offer 2FA backup codes as a backup method and only offer setting up a hardware security key as a secondary 2FA method. We'll cover that in a future article.

![](/posts/post-118.png#image-center)

There you have it! You have now secured your Google account and Paypal account with two-factor authentication.

If you need further help setting up 2FA on websites, please don't hesitate to reach out and [contact us](/contact).


How to set up Two-Step Login on Google and other websites


The internet has revolutionized the way we communicate, work, and conduct business. Today, there are countless free services on the internet that offer users a range of benefits, from social media platforms to cloud-based storage solutions. While these services may be free, there are potential privacy risks associated with using them. In this post, we will discuss the pros and cons of using free services on the internet with regards to data privacy.

## Pros of Using Free Services on the Internet

1. Cost

   The most obvious benefit of using free services on the internet is that they don't cost anything. This is particularly appealing for individuals and businesses who may not have the financial resources to pay for expensive software or subscription-based services.

2. Convenience

   Many free services on the internet are designed to be user-friendly and easy to use. They often require little to no technical knowledge, making them accessible to a wide range of users. This convenience can save time and effort, making it easier for people to complete tasks and stay connected with others.

3. Innovation

   Free services on the internet are often created by startups or individual developers who are looking to disrupt the market with innovative products. These services can bring fresh perspectives to the table and offer users unique features and functionality that may not be available with traditional paid services.

## Cons of Using Free Services on the Internet

1. Privacy Risks

   One of the biggest concerns with using free services on the internet is the potential privacy risks associated with them. Many free services collect user data, such as browsing history and personal information, in order to sell targeted advertising or use it for other purposes. This data can be vulnerable to hacking or other security breaches, which can lead to identity theft or other privacy violations.

2. Lack of Control

   Users of free services on the internet often have little control over how their data is used or shared. This can be particularly concerning for businesses, which may have confidential or proprietary information that they need to protect.

3. Unreliability

   Free services on the internet are often offered by small or new companies that may not have the resources to offer the same level of reliability and support as more established companies. This can lead to service outages, lost data, or other issues that can disrupt business operations or cause other problems for users.

4. Limited Features

   Free services on the internet may offer limited features or functionality compared to paid services. This can be a drawback for users who need more advanced capabilities or who require specific features that may not be available with free services.

## How to Mitigate Privacy Risks

While there are potential privacy risks associated with using free services on the internet, there are steps you can take to mitigate these risks. Here are a few tips:

1. Read the Terms and Conditions

   Before using a free service on the internet, be sure to read the terms and conditions carefully. This will help you understand how your data will be collected, used, and shared.

2. Limit the Data You Share

   When using free services on the internet, only share the minimum amount of data necessary to use the service. Avoid sharing sensitive or personal information, such as your social security number or financial information.

3. Use Strong Passwords

   Use strong passwords and two-factor authentication to protect your accounts from unauthorized access.

4. Monitor Your Accounts

   Regularly monitor your accounts for suspicious activity or unauthorized access. Report any issues immediately to the service provider or law enforcement.

## Conclusion

Free services on the internet offer many benefits, but they also come with potential privacy risks. As a user, it's important to be aware of these risks and take steps to protect your data. By understanding the pros and cons of using free services on the internet with regards to data privacy, you can make informed decisions about which services to use and how to use them safely.


The pros and cons of using free services on the internet


LastPass is a popular password manager that has been around for many years. However, in recent years, many users have started to switch to other password managers, including Ayam Secure Secrets (powered by Bitwarden). If you are considering making the switch from LastPass to Secrets, here is a guide on how to migrate your data:

### Step 1: Create an Ayam Secure Secrets account

Before you can start migrating your data from 1Password to Secrets, you need to create a Secrets account. Vist the [Secrets service page](/services/secrets) and pick a subscription plan. After you checkout, follow the steps on the [how to get started with Secrets page](/secrets-get-started) to create your account.

### Step 2: Export your data from LastPass

Next, you need to export your data from LastPass. This can be done by logging into your <a href="https://lastpass.com/?ac=1" target="_blank">LastPass web vault</a>, clicking on `Advanced Options` in the lower left-hand menu, and then from the `Manage your Vault` section, select the `Export` option.

![](/posts/post-38.png#image-center)

At this stage, LastPass will send you an email to confirm the export. From your email inbox, confirm the export, then return to your LastPass web vault, and select the Export option again to complete the export. Depending on your browser, your data will either be automatically saved as a `.csv` or printed to the screen in a `.csv` format.

If your data was printed to the screen, highlight the text and copy and paste it into a new `export.csv` file using your note pad editor (make sure to save the file as a `.csv` and not `.txt`).

![](/posts/post-42.png#image-center)

### Step 3: Import your data into Secrets

Once you have exported your data from LastPass, you can import it into Secrets. To do this, log in to the Secrets Web Vault in your browser (<a href="https://secrets.ayamsecure.com" target="_blank">secrets.ayamsecure.com</a>) and click on `Tools` in the top left-hand menu. Then, select `Import data` and choose the `LastPass (csv)` file format for your import. Follow the prompts to import your data into Secrets.

![](/posts/post-43.png#image-center)

### Step 4: Check your imported data

After importing your data into Secrets, it's a good idea to check that everything has been imported correctly. Take some time to go through your passwords and other data to ensure that everything is in order. If you notice any errors with your imported credentials, you can fix them manually by editing that specific credential. If you're having some issues importing your data, please follow the <a href="https://bitwarden.com/help/import-from-lastpass/#import-troubleshooting" target="_blank">troubleshooting steps</a> here or [contact us](/contact) for further help.

### Step 5: Delete your data from LastPass

Once you have successfully migrated your data to Secrets, you should delete your account from LastPass. This is an important step to ensure that your data is not compromised. To do this, log into your LastPass account and then visit this <a href="https://lastpass.com/delete_account.php" target="_blank">Delete Account</a> page to start the process of deleting your account.

In conclusion, migrating from LastPass to Secrets is a straightforward process that can be completed in just a few steps. By following the above guide, you can ensure that your data is securely transferred to your new password manager. Secrets offers a robust set of features and is a popular choice among users who are looking for a reliable and user-friendly password manager.

Next, you can read this [guide on how to use Secrets](/posts/2022-11-how-to-use-secrets/) to its full potential and keep your sensitive data safe and secure.


What is Ayam Secure Box?

Read next