The steps were right, for last year's screen
What you will learn
- Why account security screens punish a mistake differently from everything else
- A safe order of steps that leaves you able to get back in at every point
- The one test that would have saved me an evening, and takes two minutes
I was adding a physical security key to an account. A small device you keep on your keyring that proves it is you. I have done this before. I knew the steps. I typed them from memory, confidently, and locked myself out of the account for the rest of the evening.
The steps were not wrong. They were right, for the screens that existed the last time I did it. Somewhere in between, the company had moved a switch, renamed a section, and changed what happened when you turned the new method on. Instead of adding a second way to prove it was me alongside the old one, it replaced the old one. The screen said so. I did not read the screen, because I already knew what it said.
Getting back in took four steps, two devices and a phone call. All of it avoidable.
Driving to a friend's house from memory works until the council makes your usual turn one way. You do not notice the new sign, because you are not reading signs. You are reciting a route.
Why these screens are different from every other screen
Most software punishes a mistake with an error message. You read it, you undo it, you carry on. Account security punishes a mistake by taking away your ability to come back and fix it. The failure is not a wrong result. The failure is losing the door.
So the rule I now follow without exception: for anything touching passwords, second factors, recovery codes or who owns an account, I read the screens that are in front of me today, out loud, and I do not act on a remembered sequence.
It feels slow and faintly insulting, like following the instruction leaflet for a chair you have already built twice. Build the chair wrong and you have a wobbly chair. Do this wrong and you are in a support queue trying to prove you are yourself.
I now set up the way back in before I turn the lock. That ordering is the whole lesson, and it is the part everybody gets backwards, including me.
You do not notice the new sign, because you are not reading signs. You are reciting a route.
A safe order for changing how you prove who you are, written so that every step leaves you able to get back in. None of this depends on a particular company, because the whole point is that you read theirs rather than trusting my description of it.
1. Before touching anything, write down how you would get back in today
What this does: turns a vague feeling of safety into a checked list.
Why it is first: not how you think you could get back in. The actual list, tested. If you cannot complete this list, stop here and fix it, because everything after this step reduces your options.
# recovery.md, kept somewhere you can reach WITHOUT this account
# recovery codes : do I have them, where, and have I tried one?
# recovery email : can I sign into it right now, on its own?
# recovery phone : is the number still current?
# second method : is there one, on a different device?
# their support : what do they ask for to prove you are you?Test one recovery code if they let you. An untested recovery code is a belief, not a backup. Most companies cancel a code once used and show you the ones you have left, which is a fair price for knowing.
2. Get a second method working before you make the first one compulsory
What this does: gives you two independent ways in, and only then tightens things up.
Why the order is the whole thing: one way in, then tighten, is exactly how lockouts happen.
# what you want to be true BEFORE enforcing anything
# method A : the key or app on your everyday device
# method B : a SECOND key, or an app on a different device
# plus : recovery codes, printed, stored away from the computerIf you are buying keys, buy two at once. A single key is a single point of failure that you have volunteered for, and the second one costs less than an afternoon of recovery.
3. Read the screen in front of you, and name what it changes
What this does: makes you say out loud what you expect to happen, and then find that sentence on the page.
What it catches: if the page does not say what you expect, you are about to do something other than what you planned.
# the three questions, every single time
# does this ADD a method, or REPLACE the one I have?
# after saving, which methods still work?
# does this cancel my recovery codes?That third question catches a real trap. Several companies issue brand new recovery codes when you change methods, quietly making the printout in your drawer worthless. If the answer is yes, print the new ones in the same sitting.
4. Set up the second device in the same sitting
Do not plan to come back to it. Adding the second method is the step that gets put off, and the gap between "I will do that tomorrow" and "I cannot sign in" is where this whole problem lives.
5. Prove the second way in works from a cold start
What this does: signs you in using only the new method, with no help from a session that was already open.
Why this is the step that would have saved my evening: a tab you are already signed into proves nothing. It was signed in before you made the change.
# 1. open a private window, or a different browser, or another machine
# 2. sign in using ONLY the second method
# 3. then do it again using a recovery code
# 4. only now is the change finished6. Keep the secret away from the thing it opens
Recovery codes stored in the password manager that this account protects is a loop. Printed and in a drawer beats perfectly organised and out of reach. What belongs in a proper offline kit, and how to keep the secret and the storage in different buildings, is the subject of the next guide.
7. Write down the date and what the screen said
What this does: records the state you left the account in, rather than the steps you took.
Why not the steps: the steps will rot. That is the entire problem. Recording the end state means that next time you are checking a claim rather than reciting a procedure.
# accounts.md
# 2026-09, this company
# methods: key (everyday), key (spare, in the drawer)
# recovery codes reprinted this date, old set cancelled by the change
# NOTE: turning the key on REPLACED the app code method hereNone of this makes their screens hold still. They will move again. What it does is make you a person who reads the new one, instead of a person who remembers the old one.
Related reading: the things I got wrong so you do not have to has the general version of this: match how careful you are to how hard the mistake would be to undo.
This page in the original Kyber Cypher voice: The instructions were right. For last year's screen