Security
A sign-in with no password to steal.
Most break-ins begin with a password that was guessed, reused, phished or leaked. afnoCA does not have one.
6 digits
in every sign-in code
10 minutes
before a code expires
1 use
and the code is spent
5 tries
and that code is void
Why we left passwords out
Nothing to guess
There is no password at all, so there is no “password123” for anyone to try.
Nothing to reuse
A password reused from another site is how most accounts are broken into. Here there is nothing to reuse.
Nothing to keep
A code that expires in ten minutes and works once is worth nothing to someone who copies it later.
How signing in works
- 1
You enter your username
Only your username. No password field, because there is no password.
- 2
A code goes to your email
A fresh six-digit code is emailed to the address on your account. Asking again voids the earlier one, so only the newest code ever works.
- 3
You type the code
Signing in happens the moment the last digit is entered. The code is checked, then marked as used.
- 4
A sealed session begins
You stay signed in with an encrypted cookie that page scripts cannot read.
Built to resist guessing
A six-digit code is short on purpose. It is safe because of everything around it.
- Codes are stored only as one-way hashes, never as plain text, and never written to logs.
- Five wrong tries voids that code, so a code cannot be worn down by guessing.
- Requesting and entering codes are both rate-limited, so a stranger hammering the form only slows themselves down.
- Sign-in answers the same way whether or not a username exists, so it cannot be used to find real accounts.
- Wrong guesses never lock you out. You can always ask for a new code and use it.
After you are in, everything stays closed
Closed by default
Every page and every request needs a signed-in session. Only the sign-in itself, and invoice links you choose to send, are public.
Private files
Uploaded documents and attached bills are only ever served to a signed-in session, and uploads are checked for what they really are.
Invoice links stay narrow
A link you email to a customer opens that one invoice, at an address too long to guess, and nothing else.
Encrypted in transit
The site is served over HTTPS, and the session cookie is sent only over it.
Your part
Because sign-in codes arrive by email, your inbox is the key. Keep it protected with two-step verification, never share a code with anyone, and sign out when you use a shared computer.
Sign in the safe way.
No password to set, and nothing to remember except your username.