Account security: "Confirm it's you", "This wasn't me" and named passkeys

Qualflare now does more to protect your account from someone who gets into a signed-in session or learns your password. Sensitive changes need fresh proof that it's you, every security email lets you lock your account in one click, and managing your second factors is easier.

What's new

• "Confirm it's you." Before a sensitive change, such as adding a second factor, linking a Google or GitHub sign-in, creating an access token, changing SSO settings or changing an owner, Qualflare asks you to confirm with your password, an authenticator code or a passkey. You're only asked if you haven't proved it's you in the last five minutes. SSO and Google accounts confirm through their sign-in provider.
• "This wasn't me." Security notice emails, sent for example when your password changes, a second factor is added or removed, an access token is created, or someone signs in from a network you haven't used in 30 days, now include a This wasn't me: lock my account button. It signs out every session and revokes all your personal access tokens. The link works once and expires after seven days.
• Named passkeys. Name a passkey when you add it, rename it later, and see when each one was added and last used.
• Recovery codes, clearly. The two-factor page lists every factor and how many recovery codes are left, and warns you when you're down to three. Accounts that only use passkeys now get recovery codes too.
• Lost your authenticator? Replace it with a recovery code. Recovery codes can no longer be used to turn two-factor authentication off.

Availability

On every Qualflare plan.