Security and sessions

Everything on this page lives in Settings › Profile, in two blocks: Security for the password, and Session for signing out. The Session block sits above Account Removal on purpose — signing out and closing an account should not be one careless click apart.

Changing your password

At least 8 characters, with an uppercase letter and a number, and you need your current one to set a new one. The current password is shown as a permanent mask with no way to reveal it; the two new fields have a show/hide of their own, because you cannot check a password you cannot see.

Changing it signs out every other session and keeps this browser signed in. The confirmation reports the number the server actually ended — none, one, or several — rather than a promise made before the request went out.

The new password is committed first and the other sessions are ended afterwards, never the other way round. Revoking first would sign your other devices out of a password that might still fail to save, which is the worst possible order for this to happen in.

How long a session lasts

• An hour — is how long the token your browser uses is valid for.
• Thirty days — is how long the renewal behind it lasts.
• You should never notice either — the renewal happens silently on the next navigation or the next read, so a session you use is a session that keeps going.

If a renewal is refused, both are cleared and you are asked to sign in — Alltra does not leave a half-live session behind. Being asked to sign in after a month away is the design working; being asked every hour is not, and it is worth a ticket.

Being signed out of everything at once

Each renewal can be used once. If a renewal that has already been spent is presented again, every session on every device is ended immediately. That looks severe, and it is the right severity: a replayed renewal is either an attacker using a token they captured, or you using one an attacker has already used, and those two are indistinguishable from the inside. The safe reading is the hostile one.

An invented or long-expired token does not trigger it. That distinction matters — otherwise anyone could sign you out of everything by guessing.

When a revocation takes effect

Within about thirty seconds, not at the end of the hour. Alltra checks whether a session is still live on each request against a short-lived cache, and every action that revokes one clears that cache immediately — so the usual case is instant and thirty seconds is the ceiling rather than the wait. “Signed out everywhere else” means it.

Signing out

One control, in Settings › Profile › Session, and it is the only sign-out in the product. It ends the session at the server as well as clearing this browser, so a copy of your token cannot keep working for the rest of the hour. It clears three things: the session, the renewal, and the account selection this browser was carrying.

If the server cannot be reached, you are still signed out locally. Someone pressing that button while something is down must end up signed out rather than stranded on a page they were trying to leave.

Too many attempts

Ten consecutive failed sign-ins lock the account for fifteen minutes, and the refusal says how long is left. The lock is checked before the password is, so somebody who has already tripped it cannot keep testing passwords for free. Any successful sign-in clears the count. A password reset link lasts one hour and works once.

What is not here yet

There is no device list. You cannot see which sessions you have open or end one by name. The two controls that exist are signing out of this browser, and changing your password — which ends all the others and tells you how many that was. Between them they cover the case that matters, but not with the detail a device list would give you.