Keeping the account yours

A passkey is the fingerprint, face or screen lock your device already uses, standing in for a password. It never leaves the device, so there is nothing to leak, reuse or be phished out of you.

Add one per device you actually sign in from. Each is listed separately so you can remove a single one — an old laptop, a phone you sold — without disturbing the rest.

You can also require a six-digit code from an authenticator app. Setting it up shows a QR code to scan, and asks for one code back to prove the app and sizuq agree before anything is switched on.

Turning it on has one consequence worth knowing in advance: signing in with Google stops working. A code from an app you hold is a stronger claim than a third party vouching for you, and sizuq will not quietly accept the weaker one afterwards.

Switching on an authenticator app gives you a set of one-time recovery codes. They exist for the day the phone with the app on it is gone.

1. Save them somewhere that is not the device running the authenticator.
2. Each one works once, and is spent the moment it is used.
3. If you run out, or lose them, generate a new set — the old ones stop working immediately.

Some actions ask you to prove who you are a second time, even though you are already signed in. It is not a bug, and it is not because your session expired.

A signed-in browser left open is a signed-in browser anyone sitting at it inherits. For actions that cannot be undone, or that change how you get in, sizuq wants the person doing it to be present rather than merely the session to be valid.

Confirming once covers you for the next ten minutes, so a run of settings changes does not ask repeatedly. Signing out ends it immediately, as does changing your password — old proof is worth nothing once the credential behind it has moved.

Settings keeps a short history of sign-ins and security changes, so an attempt you do not recognise is visible rather than silent.

It records what happened and roughly from where, but not your address itself — sizuq keeps a fingerprint of it rather than the value, which is enough to tell two places apart without holding onto where you were.