Passwords
- At least 12 characters.
- A weak password (one of the most common ones, your name, email or company name inside it, a keyboard run like qwerty, a year) is accepted but not recommended for safety features, and it could put your company at risk if it's found. The page says why and asks you to tick I understand the risk; the company's history log shows that a weak password was accepted, never the password itself.
- Checked by the database itself, never by the app server, and stored only as a scrambled fingerprint that can't be turned back into the password. A stolen copy of the database can't be used to sign in as anyone.
- Changing your password signs you out on your other devices.
Two-factor sign-in
- After your password, Asphalt OS asks for the 6-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or Authy. The code changes every 30 seconds, and each code works only once. Until you give it, nothing opens.
- To turn it on for yourself, open your account menu (your name, top right) and choose Two-factor sign-in. Enter your password, then scan the QR code with the app (on your phone you can press Open in my authenticator app instead, or type the setup key), and type the first code the app shows.
- When your company requires two-factor sign-in, your next sign-in leads you straight into setting it up. A new company requires it from the start; people who can change company settings can turn that off on The Team & security page.
- When you turn it on you get 10 recovery codes, shown only that once. Each one lets you sign in once without your phone. Print them or write them down, and keep them somewhere safe.
- Lost your phone? Sign in with a recovery code, or ask someone who manages people and is ranked above you to reset your two-factor sign-in. You then set it up again at your next sign-in. Every reset goes into the history log.
- The database checks the code itself and holds the key behind your codes where the app server can't read it; it is never shown again after setup, and recovery codes are stored only as fingerprints. A mistyped code, at sign-in or on the account menu, counts as a wrong try (see below).
Trusting a device for 30 days
- When Asphalt OS asks for your code, you can tick Trust this device for 30 days (Not recommended if the device is shared). For the next 30 days, that browser on that device signs in with your password alone.
- Don't tick it on a computer or phone other people use.
- The 30 days count from the day you ticked it. Signing in with the device doesn't add more days; after 30 days you type a code again and can tick the box again.
- Your password is still asked every time, and wrong passwords still count toward the lock below. The trust belongs to you and the company you signed in to: someone else signing in on that browser is still asked for their own code.
- See your trusted devices in your account menu, under Two-factor sign-in: each shows the browser, when you trusted it, when it was last used and when it ends. Press Remove next to one, or Forget all devices. Both go into the history log.
- Every device you trusted is forgotten when your password changes, when your two-factor sign-in is reset or set up again, and when you leave the company.
- Asphalt OS staff accounts never get the box: the Asphalt OS team always types a code, and a leftover trust does nothing for them.
Setting two-factor up at sign-in
- When your company requires two-factor sign-in and you haven't set it up yet, signing in leads you straight into setting it up. You type your password again first, and for your first authenticator Asphalt OS also emails you a code to type in: the password alone is what somebody who stole it already has. The code is made by the database and sent by the background worker from Asphalt OS's own address, so it arrives a few seconds later. Wrong passwords and wrong codes there count as wrong tries (see below).
- The same emailed code is asked for when you set up your first authenticator from the account menu.
- You're emailed when two-factor sign-in is set up on your account, so you know if it wasn't you, and the owner is alerted when an account that had no authenticator gets its first one.
Your signed-in devices
- Open your account menu and choose Signed-in devices to see every browser you're signed in on: the browser, where it signed in from (only the start of the address, like 203.0.113.x), the company, when it signed in and when it was last active. The one you're using says This device.
- Press Sign out next to a device you don't recognise, or Sign out everywhere else. That device is out at once: its very next click lands on the sign-in page, and a phone empties its offline copy of the day's pages and switches its alerts off then (see Working on a phone); Sign out everywhere else also takes every phone of yours off the alerts list at once. Then change your password.
- Sign out everywhere else is the panic button, so it does more than its name: every browser you had ticked as trusted stops being trusted (this one too), anybody half-way through signing in as you has to start again, and every browser becomes a new browser. So the next time you sign in on your own laptop you will be asked for a code and emailed "someone signed in from a new device" — once per browser, and then it is quiet again. That email is the point: if somebody else has your password, their next visit says so.
- Each sign-out goes into the history log, with the browser that was signed out.
Your password again for dangerous changes
- Some changes ask for your password again, even though you're signed in: changing what a role may do, creating, copying, deleting or re-ranking a role, giving or taking an exception, changing someone's role, taking someone out of the company, resetting someone's two-factor sign-in, inviting someone or withdrawing an invite, the company's sign-in rules, a brand's details, approving or declining a Connections change, stopping the company mailbox, connecting QuickBooks, undoing a customer import, merging two customers, revealing a Social Security number, and downloading a bulk export (the compliance CSV files).
- The right password is remembered for 5 minutes on that device only, so a manager making several changes types it once. A wrong password counts as a wrong sign-in try (see below).
- This is so that an unattended, signed-in browser can't be used to hand out access or take data away.
Wrong guesses
- The message never says whether the email or the password was wrong, so nobody can check who has an account.
- Every try is counted and saved before it is answered, and the fifth try in a row locks that email for 15 minutes even when it is right: four guesses per quarter hour is all anyone gets, and signing in clears the count. Wrong two-factor codes count as wrong tries too, and so do wrong passwords typed again for a dangerous change.
- Sign-in attempts from one network address are limited to 10 a minute.
- When your account gets locked, you're emailed, so you know someone may be guessing your password.
Sessions
- You are signed out after a quiet spell: 30 minutes unless your company chose otherwise.
- Every sign-in ends after 12 hours.
- A disabled account, or a company that isn't active, can't sign in.
Security notices
- Asphalt OS emails you when something happens to your account: a sign-in from a device you haven't used before, your password changed, your two-factor sign-in set up or reset, a device trusted for 30 days, and your account locked after wrong tries. The email says which browser and where from (the start of the address), never a password, a code or a link to click.
- The browser you sign in from right after your account is made (accepting your invite, or setting the company up) is noted but not emailed. Every other browser you haven't used before is, including your first sign-in after this protection arrived.
- These warnings, the two-factor setup code and invitations leave through Asphalt OS's own mail account when the server has one, whatever the company's sending mode, so they reach you even while the company's own sending is still captured. Without one they follow the company's mode: on a captured company they stop at the test mailbox, the Outbox marks each one "Went to the test mailbox; the person was not told", and a banner on Connections, Team & security and My profile says so.
- Your warnings are yours alone: on the Messages page they show as "Security warning" to you and to nobody else, and nobody, not even the owner, can edit, cancel or resend one. They are written only by Asphalt OS itself, so nobody can fake a "call this number" letter under its name.
- Everyone sees their own: Your account activity on My profile lists the sign-ins from new devices, password and two-factor changes, trusted devices and lockouts on your own account, whatever your role.
- Every notice is also a line in the history log. The company's owner, and anyone who can see the audit log, has a Security tab on The Team & security page listing them: who, what, when and which device. Its Only what Asphalt OS staff did box shows every line by the Asphalt OS team, so the owner always sees what staff did. Where a sign-in came from shows only to the person and to people who manage people.
- The owner is also alerted, by a task and an email, when something looks like an attack: 10 or more wrong sign-in tries from one address in 15 minutes (the people whose accounts were tried are emailed too), 10 or more wrong tries at one account in an hour from any number of addresses, a sweep of several accounts from several addresses, 3 or more accounts locked in an hour, a Connections setting changed outside business hours, any two-factor reset, a first authenticator set up on an account, and every invitation.
The Asphalt OS team
- People in the Asphalt OS staff role must have two-factor sign-in on to use any company, whatever the company's own setting, and never get "Trust this device". Someone put into that role without it is signed out everywhere at once and sets it up at their next sign-in.
- Only Asphalt OS can put somebody into that role, and it does it once, when your company is set up. You can take somebody out of it, or out of your company, whenever you like: that half is yours. Renaming the role changes nothing, and calling one of your own roles "Asphalt OS staff" makes it none of ours — so no other company can ever change how you or your people sign in here.
- Each company gets its own staff mailbox, and nothing in Asphalt OS ever makes or shows a staff password.
- Once you have removed them, only whoever runs your server can let Asphalt OS support back in, with a one-use invitation that lasts 48 hours; nothing in the app itself can.
Behind the scenes
- Sign-in happens inside the database: the app server can't start a sign-in on its own, read stored passwords or clear a lockout, and a sign-in token can never end up in the server log.
- Names that reach a letter (a company, a brand, a role, a person, an invitee) are plain words: no line breaks and no web addresses, so nobody can slip a line of their own into an invitation sent from Asphalt OS's address.
- The sign-in cookie can't be read by scripts on the page and is sent only to Asphalt OS.
- A trusted device is remembered in a cookie of its own, which scripts can't read either and which is sent only when you sign in. The server keeps only a locked fingerprint of it.
- Every change must come from the Asphalt OS screens themselves; other websites can't make changes in your name.
- Asphalt OS pages can't be shown inside other websites.
Choose the idle time on The Team & security page.