Two-step sign-in for the dashboard

Setup is scanning a QR code with any standard authenticator app. Once it is on, signing in asks for a code from the app after the emailed link, so access to your inbox alone is no longer enough. Single-use backup codes are issued for when you do not have your phone, and they can be regenerated at any time. Turning the second step back off requires a current code, so somebody with only your inbox cannot switch it off.