Passwords, verification and resets
Sign people in with an email address and a password, verify the address, and reset a forgotten password.
Every brand offers an email address and a password. The password belongs to the person's email identity: amr is pwd.
Passwords
A new password has at least 10 characters, isn't the address or the brand's name, and, while the brand's breached_password_check is on (the default), isn't one Have I Been Pwned knows from a breach: only the first five characters of its SHA-1 hash leave Synq. Synq keeps only an Argon2id hash.
Wrong passwords slow down, per brand and address: 3 are free, then each wait doubles from a second, and the 10th locks the address for 15 minutes. Every refusal reads the same and takes as long, whether or not anyone has the address. Signing up with an address that already has an account signs its owner in when the password is right.
Verifying the address
A password sign-up leaves the address unverified, since anyone can type any address. After each password sign-in until it's verified, the hosted pages show a verification step: Synq emails a code and a link (an hour, 5 tries), and the code, the link opened in the same browser, or "Skip for now" goes on with the same sign-in. A link opened in another browser does nothing, so someone who signed up with another person's address can't get them to verify it.
Until the address is verified, the account takes no new way to sign in (a passkey, a wallet, a provider): the person verifies first. See verified email addresses.
Resetting a password
"Forgot your password?" on the password form asks for an address and answers the same page whoever has it. An account that may sign in gets a single-use link, good for 30 minutes, which works in any browser; only the newest link works. Setting a new password there:
- verifies the address (unless another user verified it)
- ends every session and grant of the user, offline ones included, and tells apps over the back channel
- clears the address's wrong-password lock
- emails the person a notice
and records user.password_reset. Reset requests count apart from sign-in tries, so asking for resets locks nobody out.
Going straight to it
Add synq_method=password to the authorization request to open the sign-in page at the password form, and login_hint to fill in the address. To take the password on your app's own page instead, see Sign in from your own UI.