Two-step verification

1. 1Profile → Two-step verification → Set up. Scan the QR code with any authenticator app (RFC 6238, so all of them work).
2. 2Enter a code. Only then does it take effect — somebody whose camera or clock failed does not lock themselves out.
3. 3Save the recovery codes. They are stored hashed, so they cannot be shown again later.

At sign-in it asks for a code after the password; five attempts, five minutes. Switching it off needs a code the same way — a second step a session can disable only stops people who are not there. No administrator can switch off somebody else's.