Security — Sessions & alerts

A sign-in lasts 30 days per device. That is a long time for a stolen cookie to stay useful, so two things bound it. • Sign out everywhere. One action ends every session on every device, immediately, including the one you are using. Changing a password by reset does the same automatically — otherwise resetting a stolen password would leave the thief's existing session working for the rest of its life, which is the opposite of what someone resetting a password believes they are doing. • Alerts you can act on. We email you when a sign-in arrives from a device the account has not used before, and when a security setting changes — password, two-factor turned on or off, recovery codes regenerated, or all sessions ended. Turning two-factor off is the first thing an attacker with a live session does, and it is silent otherwise.