Update 0.6.1: Accounts and access
New accounts are created by invitation rather than a starting password, the forced change actually applies, and access is logged.
Neu:
Invitation instead of starting password:
A new account used to produce a password you had to pass on — through a chat, an email, somehow. Now the invited person gets a one-time link and sets their own password.
The forced change applies:
If an account was created another way, the first sign-in effectively demands a new value — not a hint you can dismiss.
Access trail:
Sign-ins, failed attempts and password changes are logged. For the one question that counts in an emergency: who was in, and when.
Throttling per account:
Failed attempts count per account, not per connection. Otherwise everyone behind the same line shares one limit — and an attacker simply changes lines.
Sign-in built from our own components:
The sign-in form now uses the in-house component set. For that the input field first had to learn to be a password field — it could not do that before.