Concurrent sessions allowed across devices with no notification or revocation #140

xenushka commented 2026年04月02日 21:51:06 +02:00

Summary
Multiple simultaneous sessions are permitted from different Qubes/devices with no notification or visibility to the user.

Steps to Reproduce

1. Register and log in via dashboard on dev qube
2. Log in with the same passkey on distrust qube
3. Both sessions remain active concurrently

Expected Behavior
At minimum, the user should be notified of a new session from a new device. Ideally, users should be able to view and revoke active sessions.

Actual Behavior
Both sessions are silently active with no indication to the user.

Security Impact
If a session cookie is compromised, an attacker can maintain a parallel session indefinitely with no signal to the legitimate user. This is inconsistent with the trust model of the platform.

Suggested Fix (pick one or more)

• Enforce single-session: new login invalidates all prior sessions
• Add a session management UI showing active devices with revoke option
• Send email notification when a new session is initiated from a new device

Verified via
Two separate browser sessions on two different machines, both authenticated simultaneously.

**Summary** Multiple simultaneous sessions are permitted from different Qubes/devices with no notification or visibility to the user. **Steps to Reproduce** 1. Register and log in via dashboard on dev qube 2. Log in with the same passkey on distrust qube 3. Both sessions remain active concurrently **Expected Behavior** At minimum, the user should be notified of a new session from a new device. Ideally, users should be able to view and revoke active sessions. **Actual Behavior** Both sessions are silently active with no indication to the user. **Security Impact** If a session cookie is compromised, an attacker can maintain a parallel session indefinitely with no signal to the legitimate user. This is inconsistent with the trust model of the platform. **Suggested Fix (pick one or more)** - Enforce single-session: new login invalidates all prior sessions - Add a session management UI showing active devices with revoke option - Send email notification when a new session is initiated from a new device **Verified via** Two separate browser sessions on two different machines, both authenticated simultaneously.

ryansquared commented 2026年06月27日 01:56:16 +02:00

Enforce single-session: new login invalidates all prior sessions

This is super annoying if anyone's on the dashboard while also doing things on the CLI, and every time I find an application that does this, it tends to bother me.

Add a session management UI showing active devices with revoke option

This definitely seems like a good idea.

Send email notification when a new session is initiated from a new device

Also a good idea, but what are we considering "new"? Do we fingerprint clients and go based on that? That could be some GDPR or California privacy regulation wonkiness.

> Enforce single-session: new login invalidates all prior sessions This is super annoying if anyone's on the dashboard while also doing things on the CLI, and every time I find an application that does this, it tends to bother me. >Add a session management UI showing active devices with revoke option This definitely seems like a good idea. > Send email notification when a new session is initiated from a new device Also a good idea, but what are we considering "new"? Do we fingerprint clients and go based on that? That could be some GDPR or California privacy regulation wonkiness.