Signing in
Google, GitHub or a password. Your browser gets one opaque cookie and nothing it could decode.
Identity is handled by a specialist service rather than by us. What that screen
offers is the usual set — a Google or GitHub account, or an email and a password
— and the screen itself is the authority on which.
What your browser is given
One opaque random token, in a cookie it cannot read. No access token, no
refresh token, nothing it could decode, and nothing it could send anywhere but
back to us. A script injected into this page has no credential to find.
Ending a session is immediate
Sessions are kept here rather than handed out as tokens that expire on their
own. Revoke one and that browser fails on its very next request, rather than
whenever a token happens to lapse. See your browsers.
Signing in on a new device
Nothing to pair, no code to scan. Sign in, and that browser can open the
machines you are allowed to open — see
how your phone reaches it.
Your name and picture
They come from whoever you signed in with. beafk shows them and does not let you
edit them, because they are not ours to change. Change them where you actually
keep them and they follow.
Staying signed in
Sessions are long-lived by design — the product is meant to be opened from a
phone at odd hours. If that is not what you want for a particular device, throw
it out when you are done: your browsers.
Making it harder
Turn on two-factor.