Account Security

Your security is a top priority. Here is how the Logbook App protects your account and data.

Authentication

The Logbook App uses passwordless email authentication via one-time verification codes. This eliminates the risk of weak or reused passwords. Where it is offered, you can sign in with Google instead.

Data isolation

Your content lives in the space it was written in, and each space has a database of its own. Your own record — notifications, devices, sign-in history — is kept in another, private to you.

That means isolation runs along two lines, and it is worth knowing which is which. No space can see another space's content, and there is no shared database where a single breach could expose many people's. Within a space, though, everyone who is a member can read and write everything in it: sharing a space is what sharing means here, and it is undone by removing the member, which also closes any connection they still have open.

Encryption

• In transit: all connections use TLS (HTTPS)
• At rest: everything we store is encrypted at rest

Session management

Sessions use secure, HTTP-only cookies with the following protections:

• Cross-site request protection: sign-in cookies are not sent on requests started by another site, and the server additionally refuses authentication requests that did not come from this app's own address
• Session expiry: sessions expire after 7 days of inactivity
• Strict CSP: Content Security Policy with nonces prevents cross-site scripting
• Encrypted session storage: session records are held encrypted, and are keyed by a one-way hash rather than by the session token itself

Signing out other devices

Your account settings list every device you are currently signed in on, with the approximate location and the date it signed in. Sign out other sessions ends all of them except the one you are using.

Sign-outs can take up to a minute to reach every location, because sessions are stored across a global network. If you believe your account is compromised, sign the other sessions out and then contact support.

Recommendations

• Use a unique email address for your account
• Keep your email account secure (it is your authentication factor)
• Sign out when using shared devices: a signed-in browser keeps a copy of your spaces so the app works offline, and signing out deletes it
• Review your active sessions periodically in account settings