How Delta Academics keeps sign-in safe
- Advisers can sign in in two steps, with an authenticator app. A school's lead adviser can require it, and sees who has it on.
- No account can be tried more than 10 times in 5 minutes, from any address.
- Passwords need a capital letter and a number, and at least 12 characters for an adviser or 8 for a pupil. Common passwords, and any containing the person's name, username or school, are refused.
- Passwords are kept only in a form that cannot be turned back (argon2id).
- An adviser's session ends after 2 hours unused. A pupil's ends after an hour unused, or when the browser closes.
- Advisers can see where they are signed in and sign out everywhere else. Changing a password or turning on two-step sign-in signs out every other browser.
- Pupils never need a phone or an email address. A pupil who forgets their password gets a new code from their adviser, and the old password stops working at once.
- Sign-in links and codes work once, and expire.