mirror of
https://github.com/warmbly/warmbly.git
synced 2026-09-06 08:01:24 +00:00
100 lines
6.7 KiB
Plaintext
100 lines
6.7 KiB
Plaintext
---
|
|
title: "Security"
|
|
description: "Two-factor authentication, passkeys, and sessions."
|
|
---
|
|
|
|
Everything here lives under **Settings > Security** and concerns signing in to Warmbly. For authenticating the domains you send from (SPF, DKIM, DMARC), see [Deliverability](/guides/deliverability/).
|
|
|
|
## How signing in works
|
|
|
|
| Method | Steps |
|
|
|--------|-------|
|
|
| Password | Email, password, a 6-digit emailed code, then your authenticator code if 2FA is on |
|
|
| Passkey | Pick the passkey and unlock with Touch ID, Face ID, Windows Hello, or a security key. No password, no emailed code |
|
|
| Google / Apple | One tap, natively in the iOS app. No emailed code, since the provider already verified you |
|
|
|
|
A first sign-in with a new address via Google or Apple creates your account, workspace, and free trial automatically.
|
|
|
|
<Callout type="info" title="Passwordless by design">
|
|
A passkey is tied to your device and unlocked with biometrics or a PIN, so it already proves both something you have and something you are or know. That is why it skips the emailed code.
|
|
</Callout>
|
|
|
|
## Two-factor authentication
|
|
|
|
2FA (TOTP) adds a rotating 6-digit code to every password sign-in, so a stolen password alone is not enough. Any standard authenticator works: Google Authenticator, 1Password, Authy.
|
|
|
|
**Enable 2FA** runs three steps: copy the setup secret into your authenticator, enter a code to confirm it works (it verifies as soon as the sixth digit lands), and save your one-time recovery codes.
|
|
|
|
<Callout type="warn" title="Recovery codes are shown only once">
|
|
They are displayed a single time during setup, each works once, and they are your way back in if you lose your authenticator. Store them in a password manager before closing the wizard; **Copy all** grabs them at once.
|
|
</Callout>
|
|
|
|
At sign-in, the code submits automatically once six digits are in. Without your authenticator, choose **Use a recovery code**.
|
|
|
|
Disabling asks for a current code or a recovery code first. With 2FA off you are protected only by your password plus the emailed code, and setting it up again issues a fresh secret and new recovery codes, invalidating the old ones.
|
|
|
|
## Passkeys
|
|
|
|
A passkey signs you in with whatever unlocks your device. Nothing is phishable, because the credential never leaves the device. Current Chrome, Safari, Edge, and Firefox all support them; if yours does not, the Security page says so and you keep using your password.
|
|
|
|
**Add a passkey** prompts your device to confirm, then asks you to name it ("MacBook Touch ID", "YubiKey"). Add one per device you sign in from. A passkey syncing through iCloud Keychain or Google Password Manager is marked **Synced** and works on your other signed-in devices.
|
|
|
|
Each entry shows when it was added and last used, and can be renamed or removed.
|
|
|
|
<Callout type="info" title="No passkey on this device?">
|
|
Unsynced passkeys live only on the device that created them. On a device without one, Warmbly says none was found and you sign in with your password, then add a passkey there.
|
|
</Callout>
|
|
|
|
## Sessions
|
|
|
|
Every signed-in device appears under **Sessions** with its device (`Chrome on macOS`), location where known, sign-in method (Email, Google, Apple, or Passkey), and last activity. Your current device is tagged **This device**.
|
|
|
|
**Sign out** ends one session; **Sign out other sessions** clears everything except where you are now.
|
|
|
|
<Callout type="warn" title="If something looks wrong">
|
|
Sign out the session, change your password, and make sure 2FA is on. Signing out other sessions is the fastest way to cut off access.
|
|
</Callout>
|
|
|
|
## Password and alerts
|
|
|
|
Change your password under **Password**: current password, then a new one of at least 12 characters with upper and lower case and a number. **Changing it signs out every other device automatically**, while the device you change it on stays in. Accounts that only use Google, Apple, or a passkey have no password to change.
|
|
|
|
**Sign-in alerts** notify you when your account is accessed from a new browser and OS combination, naming the device and location with a reminder to act if it was not you. They appear in your in-app feed by default; enable email under **Settings > Notifications**, Security section, Email channel. Your first sign-in is never alerted, as there is nothing to compare against.
|
|
|
|
## What is recorded when you sign up
|
|
|
|
Creating an account records the address it was created from, the browser's user-agent string, and a score for how the email address itself reads. This is anti-abuse evidence: it is what lets the platform notice one person opening many accounts, or a wave of signups from one place, without which every account looks unrelated to every other.
|
|
|
|
- The email address is also stored in a normalized form, with plus-tags and Gmail dots collapsed, so `ada.lovelace+trial@gmail.com` and `adalovelace@gmail.com` are recognisable as the same person. This form is used only for correlation and never for signing in.
|
|
- It is recorded for every signup, not only suspicious ones. Keeping it only for accounts that already look risky would leave exactly the patterns it exists to find half-empty.
|
|
- It stays on the instance the account was created on. Workspace archives do not carry it.
|
|
|
|
Nothing here refuses a signup on its own. A single weak signal is wrong too often, and turning a false positive into a rejected account leaves a real customer with no way through.
|
|
|
|
## Cross-account patterns
|
|
|
|
Individually, every abuse control watches one thing: a rate limit watches one account, warmup health one mailbox, verification one address. Someone spreading the same behaviour across several accounts stays under all of them.
|
|
|
|
A nightly sweep looks at the group instead. It groups workspaces that were opened from the same address, or by the same email identity once plus-tags and Gmail dots are collapsed, and notices a workspace that connects an unusual number of mailboxes at once.
|
|
|
|
Findings are recorded as evidence on the [workspace posture](/guides/deliverability/), never acted on alone:
|
|
|
|
- **Three workspaces is the floor.** Two sharing an address is a coincidence.
|
|
- **Private and loopback addresses are ignored**, since every self-hosted install signs up over a LAN.
|
|
- **Sharing an address carries little weight** on its own. Offices, co-working spaces and VPNs all produce it honestly.
|
|
- **Only the last 30 days count.** Two workspaces opened from one office a year apart are not related.
|
|
|
|
## Strongest setup
|
|
|
|
1. **Add a passkey** so daily sign-in is fast and phishing-resistant.
|
|
2. **Turn on 2FA** and store the recovery codes safely, so password sign-ins keep a second factor.
|
|
3. **Review sessions** periodically and sign out anything unfamiliar.
|
|
|
|
## Related guides
|
|
|
|
<Cards>
|
|
<Card title="Deliverability" href="/guides/deliverability/" />
|
|
<Card title="Mailboxes" href="/guides/mailboxes/" />
|
|
<Card title="Team & roles" href="/guides/team-roles/" />
|
|
</Cards>
|