How to secure your Talk2m login via Email verification. – HMS Support Portal

This article explains how to enable and use Email Login Approval for your Talk2m users. As an alternative to two-factor authentication (2FA) using SMS, you can use the Email Verification Code feature, which sends a one-time code to the user's email address to verify their login.

APPLICABLE PRODUCTS

Talk2m pro, Talk2m light, Talk2m free*

PRE-REQUISITES

You need to use Ecatcher version 7.1.0 or later to configure and use this login feature.
Administrator rights are required to manage users and enable the Code by Email feature.

Things to know before using Code by Email

Once Code by Email is enabled for a user, the user must use Ecatcher version 7.1.0 or later on their PC. It is not possible to log in with an older Ecatcher version. In this case, the following message will be displayed: "This operation is no longer supported by this version of Ecatcher. Please visit www.talk2m.com to download the latest version of Ecatcher."
Code by Email is currently not supported by the Ecatcher mobile app. However, M2Web does support Code by Email authentication.
If you enable Code by Email, make sure that all administrators of your account use Ecatcher version 7.1.0 or later. Otherwise, they may experience unexpected behavior or display issues when managing users for whom Code by Email has already been enabled.

Enable Code by Email for your Talk2m users

When adding a new user with Ecatcher version 7.1 or later, you can choose between two login approval methods: Code by Email and Code by SMS.

Under the Login approval method section, choose how the Talk2m system verifies each login attempt for this user.

None:
- The user logs in using only a username and password.
- No additional verification step is required.
Code by email:
- A one-time verification code is sent to the user’s registered email address.
- The user must enter the code received by email to complete the login.
Code by SMS (Two-factor authentication):
- A one-time verification code is sent to the user's mobile phone via SMS.
- The user must enter the code received by SMS to complete the login.

Select the Code by Email option to enable this feature for the user.

What happens when Email Approval is enabled?

When Email Approval is enabled for a user, an additional verification step is required during login.

After entering the username and password, the user is presented with a Security Code screen.

A one-time verification code is automatically sent to the email address associated with the user account.
The user must retrieve the code from the email and enter it in the Security code field to complete the login process.
If the Remember this PC option is selected, the user may not be prompted for a verification code on subsequent logins from the same computer, depending on the system configuration.

Email details

The verification email has the following characteristics:

Sender: Talk2M Pro Administrator (noreply@as.pro.talk2m.com)
Subject: Talk2M log in code

The email contains a unique one-time security code required to complete the login.
The code is valid only for the current login attempt and cannot be reused.

Note: If the email is not received within a few minutes, check the Junk/Spam folder and ensure that emails from noreply@as.pro.talk2m.com are allowed by the company's email security policies.

Managing Login Approval Settings

You can configure the default login approval method applied when adding a user and define how trusted devices are managed.

This policy can be configured by Account Administrators in Account > Security Policy > Modify Login Approval Policy.

When the "Remember this PC" option is enabled, users can mark the device they are using as trusted after successfully completing login approval. Trusted devices do not require a new verification code for subsequent logins until the trust period expires.

For security reasons, it is recommended to limit the validity period of trusted devices. Once the configured expiration period is reached, users must verify the device again using a new approval code. This reduces the risk of unauthorized access from devices that are no longer under the user's control.

Ensuring Automatic Access Revocation with Email Code

If you use the Email Code feature to ensure that access is automatically revoked when a user's professional email account is deactivated, make sure the user is not allowed to modify their own settings. Otherwise, the user could change the email address associated with their account, which may prevent access from being revoked as intended when the professional email account is disabled.

When adding a new user, do not select the "May edit own properties" option.

To modify the settings for an existing user, select the user and open their Properties. In the "Permissions & Groups" section at the bottom of the Properties window, click Modify.
The displayed window allows you to configure whether the user can modify their own settings by enabling or disabling the "May edit own properties" option.

Special Use Case: Real-Time Approval of External Connections

Although this Email Login approval feature was not originally designed for access control, it can be used to provide full visibility and approval control over external connections to devices within your factory.

Configure your own email address instead of the external user's email address. When an external user requests access, the verification code will be sent to you. You can then approve or deny the connection by choosing whether to forward the code to the user.

For this setup to work:

Enter your own email address in the Email field of the external user account.
Disable the "May edit own properties" option for external users.
Use the external user's email address as the User Name. This makes it easy to identify who requested access when you receive the verification code.
Configure the "Remember this PC" setting according to your security requirements.

Note: The verification code is valid for up to 30 minutes after the login request is initiated. This gives you time to review and approve the access request before forwarding the code.

* This feature is also available in Talk2M Free, although some limitations apply to the available options and the management of Login Approval settings.