Sign-in and two-factor authentication
What is this about?
In short: your account is secured by your password, optionally by a second factor, and by protecting your sessions. If you lose access, there is a recovery key and, as a way out, an identity check. This only stays secure as long as your device and your email account are.
Protection goal
Nobody but you should be able to take over your account. If someone tries anyway, it should be noticed and stay limited.
How it works
- You sign in with your email address and password. The password is stored on the server only as a hash, not as plain text.
- If you have set up two-factor sign-in, the app then asks for a code from your authenticator app.
- After signing in, the session belongs to your device. You see all active sessions in a device list and can end them.
- If you lose your password and second factor, the recovery key helps you or, if that is missing too, an identity check by an admin.
Measures
- We store passwords only as a hash, using a set minimum cost factor to make guessing against stolen data sets harder.
- We slow down repeated sign-in attempts to reduce trial and error. We align responses and response times so that they reveal as little as possible about whether an account exists.
- We offer two-factor sign-in with an authenticator app. Backup codes are hashed like passwords and shown only once. It is mandatory for user management admin accounts and optional for author accounts.
- Sensitive actions such as changing the password or switching off two-factor sign-in require confirmation again.
- The recovery key consists of two parts, the key and a recovery password that only you know. Both are needed for recovery.
- If a session is suddenly used from another browser, we end it and notify you. After a password change, all other devices are signed out.
- If you have no recovery key, an admin checks your identity. Every such reset is logged unalterably, you are notified, and an admin cannot use it for their own account.
- Only you change your email address, with confirmation at the old and the new address. There is no admin route for it.
What we do not promise
- Whoever captures your password on a fake page gets around the protection. A second factor helps against this only in part.
- If your device or your email account is taken over, the account can still be affected.
- Two-factor sign-in is optional for author accounts. We recommend it.
- If password, second factor and recovery key are all lost, there is no automatic way. Then an admin has to check your identity, and that can be declined.
- The detection of foreign sessions has limits and does not recognize every takeover.
How we check this
The safeguards have automated tests, which the table below names. We deliberately do not name concrete limits, times or algorithm parameters. The sign-in scenarios (“Compromised User”, “Session Hijacking”) belong to the 14 attack scenarios in the monthly report.
Evidence tests
| Test | What the test proves |
|---|---|
LoginRateLimitTest |
After too many wrong sign-in attempts, sign-in slows down. |
LoginTimingEnumerationTest |
The response time is aligned so that it reveals as little as possible about whether an account exists. |
PasswordHashingCostFactorTest |
The cost factor of password hashing does not fall below the set minimum. |
TwoFactorLoginFlowTest |
With two-factor sign-in active, the password alone does not lead to a sign-in. |
TwoFactorBackupCodeTest |
Backup codes are hashed and can be used only once. |
TwoFactorMandatoryForUserManagementTest |
Two-factor sign-in is mandatory for user management admin accounts. |
AccountRecoveryRequiresBothFactorsTest |
Recovery with the recovery key needs both parts. |
SessionRevocationTest |
A signed-out or revoked device loses access. |
SessionHijackDetectionTest |
A session suddenly used with a different browser is ended. |
EmailChangeIsSelfServiceOnlyTest |
Only the account itself can change its email address, not an admin. |
TwoFactorAdminResetTest |
An admin reset of two-factor sign-in is logged and the account is notified. |
Change history
- : First version.