Keeping your signage secure: logins, two-factor and players

Anyone who logs in as you can change what's on your screens, so most of signage security comes down to protecting the logins. With Casty that means a password of at least 14 characters, two-factor authentication with an authenticator app on your phone, a separate login for each person and signing out on shared computers. The players ask much less of you: keep them out of customers' reach and leave their settings to us.

A window screen faces the street, so whatever ends up on it, the whole street sees.

A password that's long enough

Casty passwords must be at least 14 characters and include an upper case letter, a lower case letter and a number. That sounds like a lot until you try a short phrase you'll remember with a number in it, which meets the rules easily and is far easier to type than a jumble of symbols. Use it for Casty and nothing else.

To change it, click your initials in the top right corner of the CMS, then the pencil icon next to your name. In Edit User Profile, type your current password, then the new one in New Password and again in Retype New Password, and click Save.

Two-factor authentication

With two-factor on, logging in needs your password and a six-digit code from an app on your phone. Someone who learns your password still can't get in without your phone. If you only do one thing from this post, do this.

It takes a few minutes to set up:

1. Install an authenticator app on your phone. Google Authenticator works, and so does any other app that scans a QR code to set up a login.
2. In the CMS, click your initials, then the pencil icon next to your name.
3. Click the Two Factor Authentication box and choose Google Authenticator. Despite the name, it works with any authenticator app. There's an Email option in the list too. Ignore it: the Casty CMS doesn't send email, so the codes would never arrive.
4. A QR code appears. In your authenticator app, add a new account and scan it. The app starts showing a six-digit code that changes every 30 seconds.
5. Type the code your app is showing into Access Code.
6. Click Generate to create recovery codes, and copy them somewhere safe away from your phone, such as a password manager.
7. Scroll back to the top, type your current password and click Save.

From then on, after your username and password, the login page asks for a code. Open the app, type the code it shows and click Verify.

The recovery codes are the step people skip. Each one lets you log in once if you lose your phone: click Use Recovery Code instead? on the code page and type one in. If you've lost your phone and have no recovery codes either, email hello@casty.co.uk from the address we have for you.

A login for each person

If your team shares one login, ask us for a login each. Every person then has their own username and password, can turn on two-factor on their own phone, and loses access when we remove their login, with nobody else's login touched.

Separate logins also let you give people less. A supervisor who only updates the offers playlist has no need to delete layouts, and with their own login they can't. Giving staff access to the screens covers the kinds of access we set up.

Sign out on shared computers

A laptop behind the bar or a PC in the back office gets used by lots of people. Sign out every time you finish: click your initials in the top right corner, then Sign Out. Leave it logged in and your account belongs to whoever sits down next.

If you forget your password

There's no reset link on the login page. Email hello@casty.co.uk from the address we have for you and we'll set a new password, then change it to one of your own as soon as you log in. The keep your account secure help page has all of this with screenshots, and log in and find your way around covers the login page itself.

The players

A screen joins your account through a short process. The player shows a code when it first starts, someone types that code into Add Display in the CMS, and we then approve the screen and add it to your account. Until we do, it doesn't appear in your Displays list. The connect a screen help page has the details.

Once a screen is connected, a few habits keep it that way:

• Leave the Display's Hardware Key in a screen's settings as it is. It identifies the player.
• Authorise display?, at the bottom of the General tab, should stay on.
• Unauthorise, Delete and Transfer to another CMS, in a screen's menu, can each stop it playing your content. Email us before using any of them.
• The player settings tabs are ones we look after, so leave those alone too.

Players start on their own after a power cut, with no login needed. Nobody at the venue needs your Casty password to get a screen going again, so there's no reason for it to be written down anywhere near one.

The physical side

Most trouble with screens in public places is pretty ordinary. A remote gets picked up and the input changes, or a curious hand finds the stick poking out of the back of the TV.

Put sticks and boxes where customers can't get at them, behind the screen or under a cable cover, and keep the TV remote behind the bar. Many commercial displays also have settings that lock the buttons on the screen and ignore the remote, which is worth switching on in a busy spot.

Keep the players off the customer Wi-Fi if you can. A staff network or a cable is more reliable and keeps them away from the public network. Wi-Fi or wired goes through the options.

Finally, think about what goes on the screens. Anything on a customer-facing screen is public, so leave staff phone numbers and the staff Wi-Fi password off it.