Questions about the two-step verification

[Fabio]

Hi!

We are thinking in enable the two-step verification feature, but we need to know more details about the behavior, like:

1. Expiration time of each session.

2. Can I adjust and change this time? 

3. Does the user need to put the code every time they perform a push/pull/clone?

4. In addition to the mobile app, can I send the code trough sms or email too?

5. Can I enables this resource only to a single project (per-project activation)?

6. The ssh key is a pre-req? 

Thank you.

[Ben]

Hey Fabio!

Welcome to the Bitbucket Cloud community :)

1. There is no expiration time per se, once you have authenticated using 2FA - you will be able to access your account until either the browsing session is cleared or the account is logged out

2. There is no ability to adjust the expiration time

3. No, the 2FA authentication is exclusive to accessing the Bitbucket Cloud account when logging in via the website. SSH key is used for SSH authentication, App Password is used for HTTPS authentication.

4. No, 2FA authentication is handled through either mobile applications or a security key device (ie Yubikey). Resetting the 2FA codes requires you to reset this on the login screen or via SSH key - this is detailed in the following article:
https://support.atlassian.com/bitbucket-cloud/docs/enable-two-step-verification/

5. No, 2FA authentication is configured at the workspace level - it cannot only be applied to certain projects/repositories

6. SSH key is not a pre-requisite, SSH keys are used for authentication with GIT/Pipelines

Hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)