Account sign-in and recovery

Two-factor authentication adds a second step to the sign-in flow. The first step is the OTP sent to the registered mobile number. The second step is a one-time code from an authenticator app or a hardware key. The second step is required even if the OTP is intercepted.

The desk recommends two-factor authentication because the OTP can be intercepted. SIM-swap attacks, phishing attacks, and SS7 protocol attacks can all intercept the OTP. The second factor — a code from an authenticator app or a hardware key — is not vulnerable to the same attacks.

The desk's preferred second factor is a hardware key. A hardware key is a small USB or NFC device that generates a one-time code when tapped. The hardware key is not vulnerable to phishing, SIM-swap, or SS7 attacks. The hardware key is the strongest form of two-factor authentication available to a consumer.

If a hardware key is not available, the desk recommends an authenticator app. An authenticator app generates a one-time code every 30 seconds. The authenticator app is not vulnerable to SIM-swap or SS7 attacks. The authenticator app is vulnerable to phishing — a phishing site can capture the code in real time — but the window is short.

The desk does not recommend SMS-based two-factor authentication as a second factor. SMS is the same channel as the OTP. If the OTP is intercepted, the SMS-based second factor is also intercepted. SMS-based two-factor authentication is no stronger than single-factor authentication.

The platform's login is rate-limited. The platform allows 5 failed OTP attempts before locking the OTP flow. The lock is for 15 minutes. The lock is for the player's protection — the lock prevents brute-force attacks.

The platform's login is device-aware. The platform remembers the device for 30 days. The platform sends a verification email if the player logs in from a new device. The verification email is a one-time link. The link is valid for 1 hour.

The platform's login is session-managed. The session expires after 30 days of inactivity. The session expires after 90 days of activity. The expiration is for the player's protection. The expiration reduces the window for a stolen session.

The platform's login is accessible. The platform supports screen readers. The platform supports keyboard navigation. The platform supports high-contrast mode. The platform's accessibility is documented in the platform's accessibility statement.

The platform's login is audited. The platform logs every login attempt. The log includes the timestamp, the IP address, the user agent, and the result. The player can request the log via the privacy request process.

The desk's coverage is built on three principles. The first principle is editorial — does the piece serve a reader who is making a real decision. The second principle is compliance — does the piece satisfy the relevant Indian laws on responsible editorial coverage. The third principle is craft — does the piece read like a professional magazine article.

The desk's editorial team reviews every piece before publication. The review includes a fact-check pass, a source-verification pass, and a craft pass. The review is documented in the editorial principles section. The desk publishes the corrections on the affected page when a piece is updated.

The desk's recommended reading list is in the editorial index section. The list is curated by the desk. The list is updated quarterly. The list is the desk's view on the most useful pieces for the reader who is new to rummy or who wants to deepen the reader's understanding.