Accounts & invitations

No password in the clear

A new account used to generate a starting password that was shown to you and that you had to pass on — by message, by phone, somehow. A password that travels through a chat is no longer a password.

Today the invited person gets a one-time link and sets their own password. The link expires and works exactly once.

Forced change where needed

If an account was created another way, the first sign-in demands a change — effectively, not as a hint you can dismiss.

The access trail

Sign-ins, failed attempts and password changes are logged. Not for statistics but for the one question that counts in an emergency: who was in, and when?

Throttling per account

Failed attempts are counted per account, not per connection. The other way round, all users behind the same line share one limit — and an attacker sidesteps it by changing lines.