This article covers the security features every user meets in My Account and at sign-in, and the organisation-wide settings that admins control.
For every user
My Account
Click My Account in the navigation bar. It has two sections: Change Password and Two-Factor Authentication.
Changing your password
Enter your Current Password, a New Password and Confirm New Password, then click Change Password. Passwords need at least 8 characters with letters and numbers, and both new boxes must match. On success the form says Your password was changed. Other devices are signed out. Changing your password also forgets every trusted device.
Forgotten password
Click Help, I forgot! on the sign-in page. For the steps, see Registering and signing in. A reset signs out every other device but, unlike a password change, keeps your trusted devices; an admin can revoke them in your user form.
Two-factor authentication
Two-factor authentication (2FA) adds a code from an authenticator app, such as Google Authenticator, Authy or 1Password, to every sign-in, unless the browser is a trusted device (see below).
In My Account, click Enable Two-Factor Authentication.
Scan the QR code with your app. If you cannot scan, click Can't scan the code? and enter the key by hand.
Type the six-digit Authentication Code from the app. Omono checks it as soon as you type the sixth digit (or when you click Verify and Enable) and switches 2FA on if it is correct; a wrong code clears the field so you can try again.
Click Cancel to stop before then; nothing is saved. If the section says the two-factor authentication status could not be checked, click Retry. Click Disable Two-Factor Authentication to switch it off, unless your organisation requires it.
Signing in with a code
After Omono accepts your password, type the six-digit code from your app in Authentication Code. Omono submits it as soon as you type or paste the sixth digit; otherwise click Verify code. A wrong code clears the box, and Back to sign in starts again with your email address and password.
If your organisation allows trusted devices, tick Remember this device before you type the last digit, because the code is sent as soon as it lands.
If every code is refused
Codes change every 30 seconds, and Omono also accepts the code just before and just after the current one. If codes keep being refused, check that your phone's clock is set automatically from the network, wait for a fresh code and try once more. If it still fails, or you have lost your authenticator, ask an admin to open your user in Settings → Team and click Reset Two-Factor Authentication. You can then sign in with your password and set 2FA up again.
Security notification emails
Whenever 2FA is switched off on your account, by you or by an admin's reset, Omono emails you with the subject Omono Security Notification: Two-Factor Authentication Disabled, naming the admin if it was not you. If you did not expect the change, reset your password and tell your administrator straight away. No email is sent when you click Cancel during set-up.
Trusted devices
If your organisation allows it, the code step shows Remember this device. Tick it and Omono will not ask for a code again on that browser until the trust expires.
Trust is stored in the browser you used, for the email address you signed in with, so a different browser or computer, a private window or cleared site data asks for a code again.
You can have up to 5 trusted devices. Remembering a sixth removes the oldest.
Trust ends early when you change your password, when your 2FA is switched off or reset, or when an admin clicks Revoke in your user form. Signing out does not remove it.
If Omono asks for a code on a browser you remembered, the trust has expired or been removed. Tick Remember this device again.
Sessions
Omono signs you out after 30 minutes without mouse or keyboard activity. About 3 minutes before that, a message asks Are you still there? Move the mouse or press a key to stay signed in.
You can be signed in to Omono in one browser at a time. Signing in elsewhere ends the earlier session; several tabs in the same browser are fine. If your team needs one user signed in on more than one device at once, contact Omono support.
For admins
Organisation security settings
Open Settings → App → Security. Click the tick to save.
Setting | Effect |
Require two-factor authentication for every user | As soon as you save, every user without 2FA sees a Two-Factor Authentication Required screen instead of Omono, even if they are already signed in, and cannot use Omono until they set it up. While it is on, users cannot switch their own 2FA off; only Reset Two-Factor Authentication in their user form removes it. Set up your own 2FA first, so you are not interrupted. |
Allow users to remember trusted devices | Shows the Remember this device box at sign-in. Turning it off stops new devices being remembered, but browsers already remembered keep skipping the code until their trust expires or an admin revokes it. |
Trusted device duration (days, max 30) | How long a device stays trusted, from 1 to 30 days; the default is 7. Greyed out until Allow users to remember trusted devices is ticked. Shortening it does not shorten trusts that already exist. |
Resetting a user's 2FA and revoking devices
In Settings → Team, click the pencil on a user's card:
Reset Two-Factor Authentication appears when the user has 2FA on. Use it when someone has lost their authenticator. It removes the user's 2FA set-up and every trusted device, and emails the user that an admin reset it. They then sign in with their password only, and can set 2FA up again from My Account. If your organisation requires 2FA, they must set it up again before they can use Omono; if they are signed in when you reset it, the Two-Factor Authentication Required screen appears straight away. A signed-in admin can reset their own account the same way; a signed-out admin cannot, because Omono has no backup codes, so ask another admin.
The Trusted Device table lists the user's remembered browsers, with when each was Added and Expires. Click Revoke to remove one; that browser asks for a code at its next sign-in.
Things to know
Too many sign-in attempts in a row are refused for about ten seconds. If every code seems wrong, wait a moment before you try again.
Only the newest password-reset email works, and each link once; an old link still opens the form, but Save Password does nothing. If you clicked Reset Password more than once, open the last email.