Account Security, Two-Factor Authentication (2FA) & Privacy

Protecting financial telemetry and proprietary trading data requires rigorous account hardening. The Security Settings panel (Settings.jsx) delivers institutional security controls, including standard Time-based One-Time Password (TOTP) Two-Factor Authentication and GDPR-compliant cascading data erasure.

---

1. Two-Factor Authentication (2FA) Setup

Passwords alone are vulnerable to phishing, credential stuffing, and session hijacking. Two-Factor Authentication (2FA) adds a mandatory cryptographic second layer:

Provisioning Steps

1. Navigate to Settings > Security Settings (security tab).
2. Toggle the Enable 2FA switch.
3. Open your preferred authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, or Apple Passwords).
4. Scan the rendered QR Code or copy the Base32 secret key.
5. Enter the generated 6-digit TOTP code and click Verify.

Mathematical RFC 6238 TOTP Standard

The 6-digit code recalculates every 30 seconds using HMAC-SHA1 hashing:

Formula / Calculation
TOTP = Truncate( HMAC-SHA1( SecretKey, ⌊ CurrentUnixTime / 30 ⌋ ) )

---

2. Emergency Recovery Codes Protocol

Upon successful 2FA activation, the platform generates 10 single-use alphanumeric Recovery Codes:

• Offline Storage Mandatory: Copy and store these backup codes in a secure password manager or offline vault.
• Single-Use Invalidation: Each code can be redeemed exactly once if your mobile authenticator is lost, broken, or reset.

---

3. The Danger Zone: GDPR Cascading Erasure

ILoveTrading enforces strict data sovereignty. If you choose to close your account, you can initiate a complete and permanent data erasure:

1. Scroll to the Danger Zone at the bottom of the Security tab and click Delete Account.
2. Complete the brief exit survey.
3. Click Send Confirmation Code to dispatch a secure 6-digit OTP to your registered email address.
4. Enter the email OTP and click Permanently Delete Account.

---

4. Best Practices