2.0.1 went out this morning with a handful of sign-in changes:
- Password-less sign-in with a link sent by e-mail.
- Remember me: an opt-in, longer session on your own device. Nothing changes unless you tick it.
- Passkeys can be renamed (My Profile > Passkeys, 1 to 64 characters).
- Someone with a single passkey is reminded to add a second one.
- With single sign-on, a person’s name and avatar now follow the identity provider.
About the backup passkey reminder: please don’t dismiss it in your head. A passkey that isn’t synced, on a hardware key for example, lives on that one device. Lose the device when it was your only passkey and you are left with backup codes (only if you also set up an authenticator app), or with your owner contacting Hermetry support to reset your two-factor setup (that reset is written to the audit log). Each person can register up to 10 passkeys, so there is room for a second one on a phone or a hardware key.
Remember me is meant for your own laptop. Leave it unticked on a shared PC in a control room.
Docs: Two-factor sign-in and passkeys, Sessions, lockout and trusted devices.
How does remember me relate to trusted devices? We already let people trust their browser so they skip the second factor. Same thing under a new name?
Two different things.
A trusted device skips the second factor for a while, 30 days at most, and still asks for the password. You see those under My Profile > Security, with Revoke and Revoke all.
Remember me changes how long the session itself lives: every session has an absolute lifetime, and ticking remember me makes it longer. Ending sessions works as before, from Active Sessions on your profile, or an admin signing a member out of the organisation.
renamed both of mine to “phone” and “usb key”. before this I had two rows that only differed by the Added date and had no idea which was which
Our owner switched on “Require two-step verification for every member” last month. Does the e-mail link get people around that, or do they still need the second factor after clicking it?
The requirement is checked on every request, not only on the password form: from the moment it’s on, every request has to come from a session that completed a second factor. A session without one gets “This organization requires two-step verification. Sign in again and complete it.”
In an organisation like yours the shortest path is a passkey. A passkey sign-in counts as a completed second factor on its own.
Makes sense. Passkeys it is then.
- You must be logged in to reply to this topic.
Join the conversation
Sign in to ask and answer, like helpful posts and mark the reply that solved your problem. Every contribution earns points and levels.