Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign up"Review session" flow should give option to kick out malicious devices #13187
Comments
|
To be improved post-release. |
jryans
added
cross-signing-sprint
phase:4
story:1
feature:e2e-cross-signing
and removed
cross-signing-sprint
labels
|
One additional improvement would be an option to bulk delete devices that are unverified and/or have not been active for some time. E.g. see #14218 for a user that has accumulated 400 unverified sessions (by clearing browser cookies without logging out, which is not the best approach, but it does apparently happen). |
|
Also note that this is issue is particularly relevant since there is currently no way to distinguish verified from unverified sessions in the "Security & Privacy" settings (where you can delete sessions), and no way to delete sessions from the user profile page (where you can see which ones are verified), so cleaning up and deleting all unverified sessions is currently quite tricky (requiring manually comparing identifiers between these screens, I think). Edit: #13596 is related, and suggests showing verification status in the settings list. |
Currently it just lets you verify them, but to actually remove a device you're not expecting, you have to go spelunking in settings.