1The challenge
After your password, the site shows a short message encrypted to your public key.
2Your answer
You decrypt it with your private key and type the code inside back into the site.
3Why it protects you
Someone who steals your password cannot decrypt the challenge without your private key.
4A phishing bonus
A fake page cannot produce a challenge encrypted to your key unless it relays the real one, which is one more reason to check the wethenorth market link first.
Lesson summary
PGP two-factor login asks you to decrypt a challenge, which a password thief cannot do.
Looking for the current address? See the WeTheNorth link status.