I've read a lot of docs for this and I'm not completely sure of what are the conditions for the login verification code be asked. Can someone please help with this question and clarify me? Thanks
There is a really good help topic that outlines the various controls on login access to your org. Paraphrasing from it:
Step 1 is just a gatekeeper step. You won't be granted access solely based on login hours, but you must meet the criteria to get access.
Step 2 is absolute and if a profile IP range is in place completely supersedes step 3.
Step 3 only is tested if there is no profile IP range.
If Step 3 blocks your access, as I mentioned two other options exist to gain access.
The first time a new user logs into an org, if there are no IP range restrictions, they will be granted access and the cookie is set.
The verification is asked when the user is logging in from a system where there hasn't been a previous login (where there isn't a cookie present), or where the previous login has been expired (cookie expired)
System can be a physical system, but it can also be another client (Chatter Desktop for example), another browser, ...
Although supposedly cookie-based, why is it that deleting all cookies, or even using private browsing mode in Firefox, does not set off the verification code requirement? The only thing that causes it to show seems to be several days of not using a given system (or just several days regardless of use or lack thereof). If it is cookie-based, then how is Salesforce dropping cookies that cannot be deleted or that survive clearing them out? Smells like they have another way...anyone?
I have seen other sites (namely banks/credit card companies) use a similar system, but that is definitely cookie-based, as private browsing mode fails and/or clearing cookies will require new verification, but not with Salesforce...