b23ac40c0b
- login with 2FA on returns a 5-minute challenge, not a session; the session comes from /relay/2fa/verify with an authenticator code — or one of eight recovery codes, each good once (hash slot emptied) - /relay/2fa/enroll hands out the secret (QR) + codes once; enabling completes only when a real code proves the app has the secret; disable proves the code - /relay/sessions/logout kicks every device of the account from one page - password hashes are argon2id (memory-hard, OWASP parameters); stored PBKDF2 hashes still sign in — no forced reset, upgrade on next password change - TOTP is RFC 6238 (vectors pinned in tests); mobile page prompts for the second step; protocol.md documents the endpoints - fixes a double-lock in /relay/me found by the flow test (handlers hold one data guard: read through it) |
||
|---|---|---|
| .. | ||
| specs | ||
| architecture.md | ||
| install.md | ||
| multi-device.md | ||
| plan-2026-11-computer-use.md | ||
| plan-2026-11-improvements.md | ||
| protocol.md | ||
| release.md | ||