Modern Hardware Security: Looma supports modern WebAuthn / FIDO2 Passkeys across both the mobile apps and web portals. Passkeys eliminate password reuse vulnerabilities, defend against phishing attacks, and provide instant biometric sign-in.
What are Passkeys?
A passkey is a digital credential linked to your device's biometric security (Face ID, Touch ID, Windows Hello, or physical security keys like YubiKeys). Passkeys are cryptographically bound to Looma’s official domains (looma.social, looma.support, looma.gives), ensuring you can never be tricked into submitting your credentials to a fake site.
Setting Up a Passkey
- Open the side menu and select Settings (or tap the gear icon).
- Scroll to Safeguards and tap Two-Factor & Passkeys.
- Under Passkeys, tap Add a Passkey.
- Your device will prompt you to scan your fingerprint, use facial recognition, or insert your security key.
- Give your passkey a descriptive name (e.g. "MacBook Touch ID" or "iPhone Face ID").
You can register multiple passkeys across different devices for seamless access.
Step-Up Security Authentication
For sensitive operational actions, Looma enforces Step-Up Security, requiring biometric confirmation or an authenticator code even if you are already signed in:
- Requesting creator or community payouts.
- Adding or altering bank account information.
- Changing your primary email or master password.
- Transferring ownership of a Community, Organization, or Storefront.
- Exporting encrypted database backups or full account data archives.
Payout Security Cooldown (72-Hour Hold)
To defend creators and hosts against account takeover attempts, Looma implements an automated Security Cooldown:
- Trigger: Whenever you change your connected Stripe payout account, modify bank payout methods, reset your password, or change your 2FA credentials.
- Protection Period: A 72-hour protective freeze is placed on payout requests. An informative warning banner will appear in your Payout Methods and Earnings Dashboard explaining when the cooldown expires.
- Purpose: If an unauthorized person ever gains temporary access to an account, the 72-hour delay gives the true owner time to receive security alerts and reclaim their account before funds can be diverted.
Recovering Access After Lost 2FA
If you lose your phone or delete your authenticator application:
- On the sign-in screen, enter your email and password.
- When prompted for your 6-digit authenticator code, tap Lost 2FA / Try another way.
- Choose an alternative verification method:
- Passkey Login: Authenticate using an existing registered device passkey.
- Emergency Recovery Code: Enter one of the 8-character single-use emergency recovery codes provided when you first configured 2FA.
- Email Verification & Identity Review: If you do not have emergency codes, select Request Manual Recovery. Looma sends a cryptographically signed recovery token to your verified email address, followed by automated identity verification.
Safeguards Audit Log
Track all security-related operations affecting your account in real time:
- Open Settings → Safeguards → Safeguards Audit (or navigate to
/safeguardsaudit).
- Review the timestamped chronological log of:
- Device logins and operating system user agents.
- IP addresses and geo-lookup locations.
- Password and passkey modifications.
- Active sessions with options to Log out all other sessions.
Related guides
Need urgent security assistance or suspect unauthorized activity? Email our emergency security desk at security@looma.social immediately.