Security
Short answers about how identity protects passwords, sessions and tokens, and what it does not claim.
On this page
These answers summarise the Security practices page, which has the full tables. Where a protection is not built, the answer says so.
Credentials#
How are passwords stored?#
As a salted Argon2id hash, never as the password. A new password is also checked against a breach corpus, and only a short prefix of a hash leaves the system for that check. The check depends on an external service and is best effort; it is repeated in the background at later sign-ins. See Security practices.
Are passkeys safer than passwords?#
A passkey cannot be typed into a fake site, because your device signs a challenge that is bound to the real domain, and no secret is sent. That is why passkeys are described as phishing resistant. See Passkeys.
Does identity support SMS codes?#
No. No SMS or phone number is used as a factor, because of the risk of SIM swapping. An account can use a passkey, an authenticator app, recovery codes, an emailed link or an external provider where one is offered. See Signing in.
What does assurance level 2 mean?#
Two things proven, or one strong thing: a passkey with verification on the device, a password with an authenticator or recovery code, or a trusted external provider that asserted multi-factor. Level 3 needs an attested hardware passkey and is Planned: identity does not verify attestation yet. See Assurance and method values.
Does an extra sign-in step make my account two-factor?#
No. The optional steps that add a password after an emailed link, or an emailed code after a password, add a check but stay at level 1. The sign-in page says so.
Sessions and tokens#
How does identity limit a stolen session?#
The session cookie is host-locked, HttpOnly and Secure, and the server looks the session up on every request, so ending a session takes effect at once. Sensitive changes need a fresh second factor. A stolen live session can still read and end other sessions, which the security page states. See Sessions and tokens.
What if a refresh token is stolen?#
Every use rotates the token. If a retired token is presented again after a short grace window, identity revokes the whole family and ends the session. Third-party refresh tokens also live at most 7 days sliding and 30 days absolute. See Token lifetimes.
What if an access token is stolen?#
It lives at most 15 minutes, has one audience, and for every client except a first-party web client it is bound to a key through DPoP, so it does not work from another machine without that key. See DPoP.
Can an account recovery I did not start be stopped?#
Yes. The owner is emailed about a recovery, and a signed-in session shows a notice with a cancel button. The recovery paths are described on Security practices.
Assurance#
Has identity been independently audited?#
No. The security page says that no outside party has audited or certified the platform. It lists what is not claimed. Read that list before you rely on a statement.
Where do I report a vulnerability?#
Follow Vulnerability disclosure. The security contact is also on Security practices.
What happens if there is an incident?#
See Incident response.
Does identity send my password to anyone?#
No. Only a five-character prefix of a SHA-1 digest of a new password goes to the breach corpus, never the password, the full digest or an account identifier.
Will TDACorp ask for my password by email?#
No. The platform never asks for your password by email. A link in a security email takes you to a page on the identity site that asks you to confirm or deny.