Kristian WindandClaude Opus 5
997dffe01c
To nye sider. Postkasser: at stjerne i Gmail eller flage i iCloud og Fastmail bliver til opgaver, at hver postkasse hører til den, der forbandt den, at app-kodeord er noget andet end ens rigtige, og at Office 365 ikke kan nås ad den vej — sidstnævnte skrevet ned frem for at blive opdaget ved at prøve. Og at logge ind: kodeord, totrinskode og passkeys, med hvorfor en passkey ikke kan laves på en bar IP-adresse. Konfigurationen manglede VERDANDE_SECRET_KEY, som er den, det koster mest ikke at vide noget om: mister man nøglen, skal postkasserne forbindes forfra. Begrundelsen står med — det er kopierne, ikke serveren, der er problemet, for de kan hentes gennem fladen. Og genvejsafsnittet i quick-add beskrev q, t og u, som ikke findes længere. En dokumentation, der lover taster, der ikke gør noget, er værre end ingen: man prøver, der sker intet, og så tror man appen er i stykker. Bygget med --strict; alle krydshenvisninger rammer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1.6 KiB
Signing in
Three ways in, and you can have all of them at once.
A password
What the first account is created with. Nothing is emailed, nothing is registered anywhere: the first person to open a fresh instance creates the administrator account, and after that people arrive by invite link.
A code on top of it
Settings → Account → Two-factor. An ordinary TOTP secret — any authenticator app reads the QR code. Once it is on, the password alone is not enough.
Recovery codes are shown once, when you turn it on. They are the way back if the phone is gone, and they are not shown again.
A passkey
Settings → Account → Passkeys → Add a passkey.
A key on a device instead of a secret in your head. The private half never leaves the device — a phone's secure element, a laptop's keychain, a hardware key — and the signature is bound to the address it was made for, so a convincing copy of the sign-in page at a different address gets nothing.
Give each one a name you will recognise later. min bærbare is what makes a list of keys reviewable, and a list nobody can read is a list nobody revokes from.
Passkeys need the address in VERDANDE_BASE_URL to be a hostname. Browsers refuse
to make one for a bare IP address, so an instance reached at http://192.168.1.10:8080
will show the passkey section as unavailable rather than failing at the moment
somebody tries.
!!! note "One is enough, two is better" Lose the only device holding your only passkey and you are back to the password. Keep the password, or register a second key — a phone as well as a laptop.