Devices
A device is the browser of a phone or computer that you add to your account so the panel can send it notifications. Open the Devices page from the Push Notifications or the Push Verification row on the Password & Security page.
A device does one or both of these:
| Function | What happens |
|---|---|
| Sign-in alerts | A notification when somebody signs in to your account from another browser, and when somebody enters your correct password but doesn't complete the sign-in within five minutes. On when you add a device. |
| Approve sign-ins | After your password, the sign-in page shows a number and waits. Your devices show a notification: open it, check where the sign-in comes from, and select the same number. Off when you add a device. |
Sign-in alerts work for every account, even one without a password. Approvals need the authenticator app; see the rule for approvals.
Add a device
On the phone or computer you want to add, open the Devices page, select Add This Device, and choose what the device does. The panel asks you to confirm your identity first, then the browser asks whether the site may show notifications. Answer yes.
Once added, you can:
- rename it;
- turn alerts on and off with Get Alerts and Stop Alerts;
- turn approvals on and off with Approve Sign-ins and Stop Approvals;
- send a test with Send a Test Notification;
- remove it with Remove Device.
Before a device starts approving sign-ins, the panel asks you to confirm your identity again. Adding a device, and letting one approve sign-ins, each send an email to your System Mailbox.
Add the panel to the Home Screen first, open it from there, sign in, and then add the device. Safari doesn't show notifications for a site that's only open in a tab.
The rule for approvals
A device can approve your sign-ins only while the authenticator app is on. Turn the app off and every device stops approving and keeps only its alerts. Setting the app up again later doesn't bring the approvals back; you turn them on again for each device.
The reason: a notification isn't reliable. It needs your browser running, the site allowed to show notifications, and the browser maker's service to deliver it. If an approval were your only second step, you couldn't sign in on the day the notifications stop; with the app, you can always type the code instead.
How an approval works
- A request is valid for two minutes. Send Again on the sign-in page sends a new one.
- A device never approves its own sign-in. To approve on your phone, sign in on a different computer or phone.
- If the request doesn't arrive, select Use your authenticator app and type the code. A backup code works too.
- On the code prompt, Approve on another device sends the request to your devices again.
The panel then refuses the sign-in, sends no requests to your devices for 30 minutes, records the attempt in your account activity, and emails your System Mailbox. The person knew your password, so change it immediately.
An approval isn't resistant to phishing: a fake sign-in page can show you the real number. So the approval screen shows the sign-in's location and browser for you to check first; a badge after the location marks a VPN, a Tor exit node, or a datacenter (see A badge on a location). A passkey is safer: it only works on the real site.
Some limits
- One browser, several accounts. A phone or computer can be a device of more than one account: sign in to each and add it again. One browser can serve ten accounts at most.
- One panel address. A device belongs to the panel address where you added it. If you sign in at more than one address, add it at each.
- A device that only shows alerts is not a second step. It gets no approval requests.
- The notification service. Notifications go through the browser maker's service, e.g. Google, Apple, Mozilla, or Microsoft. The contents are encrypted, so the service can't read them, but it knows when the panel sends one.
- If the page says Devices are not available on this panel now, the server can't send notifications. Ask your hosting provider.