Your password
Nobody can read your password, admins included. The ledger never stores it: it keeps only a one-way scramble of it, made slow on purpose, so even someone with a copy of the database can't read it back or cheaply guess it.
If you forget it, ask an admin for a reset link. It works once, lasts three days, and signs you out on every other browser when you use it. The ledger doesn't send email, so the admin passes the link on to you directly.
Your email address
Nobody can join the ledger without an invite an admin made for their email address. The invite code works only with that address, once, and runs out after two weeks, so an account under your address can only be made by whoever received your invite.
Staying signed in
Signing in keeps you signed in for 30 days, or until you sign out. It gives your browser a long random key in a cookie that page scripts can't read. The ledger stores only a fingerprint of that key, not the key itself.
Permissions
What you can see and change depends on your role, and the server checks it on every request.
- Members see every project and change the ones they lead or collaborate on. They can comment, review proposals and ask to join a project.
- Guests see projects that are underway and shared with guests, or only the projects an admin has picked for them, plus any they've been added to. They change only the projects they've been added to, and can't start projects. A guest account ends a year after it's made, or on an earlier date an admin sets; after that it can't sign in and its keys stop working until an admin extends it.
- Admins see and change everything, and manage accounts.
The rules aren't just hidden in the page, so they hold for scripts too.
Scripts and agents
A script or agent can post as you with a key you make on the Agent keys page. A key can do what you can do in projects, but it can't make other keys or manage accounts. Each key expires after 30 days to a year. The ledger stores only a fingerprint of each key and shows the key itself once, when you make it. You can revoke your own keys, admins can revoke anyone's, and a revoked key stops working straight away.
Recovery and backups
An account can be switched off at once, and everything is backed up daily.
- An admin can switch an account off. That signs the person out everywhere at once and stops them signing in. Their projects and posts stay.
- The server saves a backup of everything once a day and keeps two weeks of them. Admins can also download a backup to keep elsewhere.
- Backups include every account's password hash, never the password itself. Admins keep them private.
Outside requests
Your projects, figures and account stay on the ledger's own server. There is no tracking or analytics. The only outside request is for the page's fonts, which load from Google Fonts.
Technical details
- Passwords are stored as salted scrypt hashes.
- Sign-in keys and agent keys are stored as fingerprints, never as the keys themselves.
- The sign-in cookie is HTTP-only, so page scripts can't read it.
Reporting a problem
If you think someone has used your account or one of your keys, tell an admin straight away, or email marcus.b.anderson@gmail.com. They can switch the account off, which signs it out everywhere, or revoke the key, and then send you a reset link.