Almost every compromised account we have dealt with had one thing in common: a password that was correct, and nothing else standing in the way.
Two-factor authentication means a stolen password on its own is not enough. Setting it up takes about two minutes.
Setting it up
Account → Security → Two-factor authentication → Enable.
You will need an authenticator app on your phone. Any of them work — Google Authenticator, Microsoft Authenticator, 1Password, Authy, Bitwarden. If you already use a password manager, use its built-in one; it is one less app.
Scan the QR code, type the six-digit number it shows, done.
Save the recovery codes
You get ten single-use recovery codes. Save them somewhere that is not your phone.
This matters more than it sounds. If your phone is lost, stolen or reset, those codes are how you get back in. Print them, or put them in a password manager that syncs elsewhere.
Storing them in a note on the same phone that holds the authenticator defeats the entire arrangement.
Why not SMS?
You will notice we do not offer text messages as an option. SIM swapping — where somebody persuades a mobile carrier to move your number to their SIM — is common enough that SMS is no longer considered a serious second factor.
An authenticator app generates its codes on the device itself. There is nothing for an attacker to intercept.
Where else to turn it on
Your MyEasyBase account is not the weakest link if everything else is open. Start with your email account: it is the master key to everything else, because everything else has a "reset my password" button that mails a link to it. If you protect one thing, protect this.
While you are in there
Check the active sessions list. Anything you do not recognise — an unfamiliar city, a browser you do not use — should be revoked, followed immediately by a password change.
Check your recovery email is one you can still get into. An old work address on a domain you no longer control is a locked door with the key on the other side.
If you get locked out
Use a recovery code. If those are gone too, we can verify your identity another way and reset it — expect us to ask for proof of ownership, because the alternative is that anybody who claims to be you can bypass the security you just enabled.
That process takes hours rather than minutes. The recovery codes take seconds. Save them.