Account session management

Browsing6853

It should be possible to see where the account is being used and have the possibility to logout from other devices.

Protonmail's approach: log only the app (e.g.: web) and (last access?) date. It also have an option to log more information, which is disabled by default.
.

Tutanota's approach: log client (user-agent) and last access. IP address logging is optional and is encrypted.

Vlad

Browsing6853 How important is this? Your kagi account information does not carry anything of value to a hacker? (just doing a thought experiment)

Browsing6853

Vlad It's more about the credit consumption in my case. There is no way if I forgot the login in my friend's house or something like that. A simple button to invalidate every other device (= every other active session token) is a good start.

Vlad

Browsing6853 If you used your session token, a simple way to invalidate is to log out (even when you come back home). This does not work if you created and used multiple session tokens (not sure why would you). Not a full solution but its a start.

Browsing6853

Vlad I'm not sure if I understood correctly, but the issue is that people will use the normal username-password to sign in in other devices (I don't think people are using session tokens beyond setting default search engines and private windows of their own computer), which, if I understood correctly, will create a new token that can't be invalidated once I don't have access to the device.

Fernandez

Vlad It is impossible for me to remember the session token and carry it around. But I can with username + password.

I have logged in Kagi on multiple devices (phones, tablets, computers). And I think it would be much more convenient to manage account sessions from on device. Like we can do it with google right?

I will say an example to supplement: I sometimes use other people's computer or public computers. I will open an incognito window and login to Kagi. Everything's down, I usually close the incognito window without logout Kagi. Will that kind of session expire? idk if this will cause some problems in Kagi's backend while these temporary sessions stack up.

Vlad

Browsing6853 Use username-password on your friends device and not log out? That is smelling like trouble even with session management (which we should have, trying to understand how to prioritize it)

Browsing6853

Vlad Yeah, it's very troubling, but I don't think even power users will prefer to use a session token (which in some cases means typing the whole string) instead of their password when the security advantage is not that clear (I mean, it's not obvious how session tokens are better). For example, yesterday I authenticated with my username-password in my phone because the phone's password manager was much easier to access.