Passwords and Sign-In

Nonbl has three kinds of password a person chooses:

Password	Chosen on	Used to sign in to
Account	nonbl.com (sign-up, reset, account page)	nonbl.com
Root	nonbl.com, when you create a Slot or change its root password	the Slot, as its root user
Slot user	the Nonbl client, by the Slot’s root user or by that user themselves	the Slot, as that user

All three follow the same rules. MQTT devices do not use a password a person chooses: a device signs in with a secret the Slot generates or with a certificate (see the MQTT broker’s credentials).

The rules

• At least 15 characters, at most 128. Spaces, accented letters and most emoji count as one character each; an emoji built from several joined symbols (a family, a skin tone) counts as each of its parts.
• Not built from names tied to it. A password made only of the service name, your email, the Slot name or the user name — with digits, punctuation or spaces added — is refused. A passphrase that merely contains one of those words is fine.

Nothing else is required: uppercase, lowercase, digits and symbols are all optional, and a password never expires. Longer passphrases are better — a few unrelated words are easy to remember and hard to guess. Password managers, autofill and paste all work.

The forms on nonbl.com and in the client show the rules next to the password field, and a refused password always says which rule it broke.

After failed sign-ins

Wrong passwords are counted per account, and per user on a Slot:

• Every 10 wrong passwords in a row start a 5-minute pause. During the pause, sign-in is refused even with the right password, and the message says how long to wait.
• After 100 wrong passwords in a row, the password is disabled until a new one is set. Waiting does not re-enable it.
• A successful sign-in resets the count.

A pause or a disable caused by failed attempts does not sign you out anywhere you are already signed in.

Getting back in

Password	When it is disabled
Account	Use Forgot your password? on the sign-in page. The email lets you set a new password; setting it ends the disable.
Slot user	Ask the Slot’s root user to set a new password for you in the client.
Root	Sign in to nonbl.com, open the Slot, and choose Change root password.

Anyone who can reach your Slot can try the root user

Every Slot has a user named root, so someone who can reach your Slot can guess at its root password. The pauses above apply to the account, not to an address, so disabling your root password takes at least 45 minutes of sustained guessing however many addresses it comes from. If it happens, setting a new root password on nonbl.com gets you back in at once. A long, unique root password makes the guessing itself hopeless.

Sessions

• A session lasts at most 30 days from the moment you signed in with your password. After that you are asked for your password again, on nonbl.com and in the client.
• Changing a password signs out everywhere else. When you change your account password, every other nonbl.com session ends; the one you changed it from stays signed in. Resetting a forgotten password ends every session. When a Slot user’s password is set, or root’s password is changed on nonbl.com, that user’s sessions on the Slot end. When you set your own password in the client, the session you set it from stays signed in.
• Disabling a Slot user ends that user’s sessions at once.

Confirming sensitive changes

nonbl.com asks for your account password again before it:

• changes a Slot’s root password,
• deletes a Slot,
• deletes your account.

A wrong password here counts like a wrong sign-in.

Privacy

Sign-up, sign-in and password reset answer the same way whether or not an account exists for an email address, so they cannot be used to find out who has a Nonbl account. If the address already has an account, the email you receive says so. The one exception is an account under a pause or with a disabled password: sign-in says so, because its owner needs to know how to get back in. A pause takes at least 10 failed attempts on the account, a disabled password 100 — or an operator’s decision after a suspected compromise.