Two-Factor Authentication Evangelist Locked Out Of Own House By Smart Lock He Insisted On

A cybersecurity consultant who spent six years convincing friends, family, and clients to enable two-factor authentication on every possible service has been locked out of his own home after the smart lock system he installed required a TOTP code from an authenticator app located on his phone, which was charging on the kitchen counter inside the locked house. Martin Nonce, 43, installed the Fortify Pro smart deadbolt system three months ago, replacing a traditional key lock that he described as "a single point of failure from the 19th century." The Fortify Pro requires both a six-digit PIN and a time-based one-time password from an authenticator app to unlock. "I configured it exactly as I would configure any critical system," Nonce explained from his front porch, where he spent two hours and fourteen minutes on a Tuesday evening in March. "Strong first factor, hardware-bound second factor, no fallback to SMS because SMS is not secure. The system worked perfectly. The system kept me out." Nonce's wife, who was home at the time, watched him through the front window for approximately twenty minutes before opening it to inform him that she had told him this would happen, in those exact words, on the day he installed the lock. "She said 'What if your phone is inside?' and I said 'Why would I leave my phone inside?' and she said 'Because you always leave your phone inside,' and I said 'That's why we have backup codes,'" Nonce recounted. "The backup codes are in a fireproof safe. The safe is in the closet. The closet is inside the house." Nonce's wife declined to open the door, citing what she described as "an educational opportunity." She eventually relented after Nonce agreed, in writing on a napkin slid under the door, to install a traditional key-based backup mechanism. The key is now hidden under a garden gnome. Nonce has described this arrangement as "a security downgrade that I am choosing to frame as defense in depth."