July's work looked at making account access easier and different ways to explore the network. We also spent time keeping the software manageable for the years ahead.
We got a second door lock, and the dialling computer found its bearings. Account activity has more to say. We gave some borrowed machinery a closer inspection, and a wayward button reported back for duty.
Passkeys
You can now sign in to Alpha-Fox with a passkey, an alternative to passwords. Your device stores it, and your browser handles the login prompt.
Once you add a passkey, when you choose "Login with passkey" on the website. Your browser will ask you to select which of the passkeys you configured for the site to login with, and your choice identifies the account. You won't need to type your Alpha-Fox username or password for that login.
I realise some people might be concerned that this is just adding more annoyances while logging in, but unlike some other sites, we're not using this for multi-factor logins. We do not add a passkey prompt after your password as an extra login step.
From password fingerprints to a key and a lock.
In March's password explanation, we compared a password hash to a fingerprint. A hash is a value calculated from your password. The website keeps that value and uses it to test whether the password you enter matches. It does not need to keep the original password.
That still leaves something for an attacker to guess. If someone steals password hashes, they can try candidate passwords and compare the results. Slow hashing methods make each guess more expensive. A long, unpredictable password makes it more difficult to guess.
A passkey creates a key and lock mathematically ℹ️. The key is the secret part, kept by your device and an unique one per site.
Why are passkeys secure?
Passkeys are tied to the website they were created for. This helps protect against phishing ℹ️, where a fake login page tricks you into revealing your password. A copied Alpha-Fox login page on a lookalike address cannot ask your browser to use the real site's passkey. The browser checks the site's identity, even when the copied logo looks convincing.
Your device creates the keys, so there is no short password to invent or reuse across several websites. Some password managers also synchronise passkeys between your devices. Other passkeys stay on one device or a physical security key. The options depend on where you choose to store yours.
Adding and managing passkeys
When you are signed in, open passkey management. Give the new passkey a name you will recognise later, such as "My phone" or "Personal password manager". Enter your current Alpha-Fox password. Select "Add Passkey". Follow your browser's prompt to finish adding it.
You can add more than one passkey and rename them later. The page shows when each passkey was created and last used, along with the browser and network address involved. It also highlights the passkey used for your current login.
If you no longer use a passkey, you can delete it. You can also end its other sessions, which are active website logins. The "Revoke sessions from this passkey" option starts selected. It ends those other logins and leaves your current browser signed in.
Passkeys are optional. You can still sign in with your password. If you lose access to both, follow the existing password reset instructions to regain access.
Extra check for administrators
For certain sensitive administrator actions, we use passkeys for two-factor authentication (2FA). The administrator must already be signed in and approve a fresh passkey request before gaining the extra access. Ordinary users never see this extra administrator request.
Maps
You can now explore the network through Alpha-Fox Maps. It shows Stargates on Second Life's map, so you can see which gates are near each other. Thank you to Horny Nuzzle for the map work.
The map offers another way to choose a destination alongside ASN Browse and the Stargate database. You can browse a familiar area or look for gates near a favourite destination.
The map follows the public listing rules for random dial. Gates must be online, listed for random dial, have their shields down, and meet the public access requirements. Private gates do not appear in this listing.
The Filter panel lets you search by different criteria, including taxonomy data.
Login messages through AFVI
Alpha-Fox now sends account activity messages to your linked Second Life avatar through AFVI ℹ️, our Virtual Interface system. It carries messages between the website and Second Life. The alerts cover new website logins with a password, a passkey, or a Stargate settings link.
Adding a passkey also sends a message, so you can spot one you did not add. Changing your password triggers a message too. Renaming or deleting a passkey does not currently send an in-world message.
Each login message identifies the login method, browser, and IP address ℹ️, which is the network address used for the connection. It also includes IPinfo ℹ️ and AbuseIPDB ℹ️ links for more information about that address. AbuseIPDB lets you see whether others reported harmful activity from that address.
The passkey-added message includes the browser and IP address used to register it. Administrators also receive an in-world message when they unlock the protected administrator controls with a passkey. That message names the passkey used.
These security messages go through AFVI even when your account has an email address. They extend June's work on password and login-link delivery with alerts about account activity. If AFVI cannot deliver a message, your login or account change still completes.
If you receive an unexpected login message, open your active sessions. The page shows the details of your active website logins. You can end any that you do not recognise.
If a passkey-added message is unexpected, open your passkey management page. Remove any passkey that you do not recognise. Keep the session revocation option selected to end its other logins too.
Keeping dependencies under control
We usually avoid adding dependencies, which are software packages from other projects. Each package needs attention alongside our own code. Its developers can stop maintaining it, change requirements, etc. All of which are annoyances for long running projects.
We previously had to maintain our own version of a package that formats website text where we had to maintain that package working with our website which added a lot of unnecessary complexity.
We use some established software to handle passkey security checks, and Maps uses outside software to draw the map. We choose these packages for a specific purpose and keep their use limited to that purpose. We've also designed our systems to tollerate the scenario where we might need to stop using them.
Change Avatar button
Horny Nuzzle also spotted a broken Change Avatar button on the profile edit page. We corrected its link to the avatar guide. That guide explains how the website gets your profile picture and how to change it.
Final Thoughts
I really didn't want to post this news as late as I did, however, writing isn't something I'm the best at and takes me a lot of itteration. I was really pleased to see our progress in July and thankful to all that helped.
