Security and signed-in devices

See where you’re signed in

Open Settings and go to Security. Signed-in devices lists every browser signed in to your account: this device first, then the rest, the most recently used first. Each row names the device by its browser and system, then roughly where it signed in from, such as “Chrome on Mac · Jakarta, Indonesia”, and says when it signed in and when it was last active.

The place is the city and country, or the country alone, that Carya’s network provider associates with the connection a device signed in from. It’s approximate: a VPN or a mobile network can put a device somewhere else. A device with no known place shows its name alone. The list shows no IP address, and the place goes when the device is signed out.

Sign out a device

Select Sign out next to a device to sign out that device only. Your own device is marked This device and has no button. Sign out everywhere else signs out every device except the one you’re using, and is unavailable while this is the only one.

If you don’t recognize a device

1. 1Sign it out, or select Sign out everywhere else.
2. 2Select Change password and choose a new one.

Signing a device out doesn’t change your password, so anyone who knows it can sign in again. A new password signs out every device, so whoever knew the old one loses their session.

Change your password

1. 1Open Settings, go to Security and select Change password.
2. 2Type your email and select Send reset link.
3. 3Open the email and follow its link within 1 hour. A link works once.
4. 4Choose a new password of at least 8 characters, then log in with it.

2-step sign-in

With 2-step sign-in on, logging in with your password also asks for a 6-digit code from an authenticator app on your phone, such as Google Authenticator, 1Password or Authy. Google and Apple sign-in ask for their own.

1. 1Open Settings, go to Security and select Turn on next to 2-step sign-in.
2. 2Type your password, if your account has one, and select Continue.
3. 3Save your backup codes somewhere safe, like a password manager, then select I’ve saved them. Each one signs you in once if you lose your phone, and they show only this once.
4. 4Scan the QR code with your authenticator app, or type the key into it, then type the code it shows and select Turn on.

Turning it off and making new backup codes ask for a code first. After five wrong codes, Carya takes no more for 15 minutes.

Sign-in alerts

When your account signs in from an IP address it hasn’t used in the last 30 days, Carya emails you. The email says roughly where the sign-in came from when Carya can tell. Nothing to do if it was you. If it wasn’t, select Reset your password in the email: that signs your account out everywhere, whoever signed in included. You can turn these emails off in Settings › Emails.

Carya keeps the IP addresses an account signs in from, for this and to stop abuse: each address as it is for 7 days, then only a scrambled form of it that can’t be read back, which Carya deletes at 30 days. The Privacy policy has the details.