Having recently enabled two-factor authentication (2FA) on BREWW, we were surprised to find that users can still remain logged in indefinitely.
It would be helpful if the system included an automatic log-out after a defined period of inactivity. This would reduce the risk of unauthorised access where a user remains logged in on a shared or unattended device.
Thanks for the suggestion, Anthony.
The good news is that there is already an automatic logout. It’s set to 6 weeks after login, regardless of when the last activity was. Does this satisfy what you’re looking for, or did you want something else, such as being able to customise this time period for users of your brewery?
Cheers!
Hi Luke - if the 6 weeks could be reduced to say, 6 hours, I think it’d be much more secure. If an unauthorised user gained access to our account, they could do a lot of damage in 6 weeks. Cheers, Anthony
Thanks, Anthony. We’re not going to change this to 6 hours at this time, I’m sorry. At the moment, it’s a single session length for all user accounts, and we don’t agree with such a short default.
I’ve renamed your feature request to let you define the session length yourself (specifically for users of your brewery account). Once this has been implemented, you will be able to set this time to whatever works best for you.
As a lot of damage can be done in just minutes, let alone 6 hours or 6 weeks, the key mitigation for this risk is to ensure that nobody ever has unauthorised access.
I would recommend that on shared devices, users are educated to always log out before they walk away from the device and not to save passwords on the device (or use a secure password manager with individual user logins).
For non-shared devices, I’d make sure the device requires a PIN or password to unlock, and that users are educated to always lock the screen before walking away. All major operating systems also allow you to specify a time at which the device will automatically lock if not used.
Please don’t forget to vote for your own request, as every vote counts.
Defining the session length by company sounds like a great idea. In the meantime, we’ll try to train the team to log out, but I’m not going to hold my breath with that one! 