The user profile was rebuilt in three tabs: Data, Security, and Sessions and Devices. The last one is new.
Sessions and devices
The list shows every access open on the account, with the browser and operating system identified. You can end a specific access or all the others.
- The session in use has no end button: it would drop the person in the middle of the operation.
- Ending a session checks its owner on the server. The identifier coming from the browser is not enough to drop someone else's session.
- Ending "all the others" requires the current session, so it does not become a disguised global sign-out.
Security
- The password strength meter uses the same minimum the server requires, twelve characters. Approving eight on screen and refusing on submit would mislead the person typing.
- The QR code and the second-factor key are only generated when the person asks to set it up, not on every profile load.
- Changing the email or password still goes through identity confirmation.
Source: Core · req-118 · BATCH-119