Security and logged-in devices

See where you’re logged in

Open Settings and go to Security. Logged-in devices lists every browser logged in to your account: this device first, then the rest, the most recently used first. Each row names the device by its browser and system, then roughly where it logged in from, such as “Chrome on Mac · Jakarta, Indonesia”, and says when it logged in and when it was last active.

The place is the city and country, or the country alone, that Carya’s network provider associates with the connection a device logged in from. It’s approximate: a VPN or a mobile network can put a device somewhere else. A device with no known place shows its name alone. The list shows no IP address, and the place goes when the device is logged out.

Log out a device

Select Log out next to a device to log out that device only. Your own device is marked This device and has no button. Log out everywhere else logs out every device except the one you’re using, and is unavailable while this is the only one.

If you don’t recognize a device

1. 1Log it out, or select Log out everywhere else.
2. 2Select Change password and choose a new one.

Logging a device out doesn’t change your password, so anyone who knows it can log in again. A new password logs out every device, so whoever knew the old one loses their session.

Change your password

1. 1Open Settings, go to Security and select Change password.
2. 2Type your email and select Send reset link.
3. 3Open the email and follow its link within 1 hour. A link works once.
4. 4Choose a new password of at least 8 characters, then log in with it.

2-step log-in

With 2-step log-in on, logging in with your password also asks for a 6-digit code from an authenticator app on your phone, such as Google Authenticator, 1Password or Authy. Google and Apple log-in ask for their own.

1. 1Open Settings, go to Security and select Turn on next to 2-step log-in.
2. 2Type your password, if your account has one, and select Continue.
3. 3Save your backup codes somewhere safe, like a password manager, then select I’ve saved them. Each one signs you in once if you lose your phone, and they show only this once.
4. 4Scan the QR code with your authenticator app, or type the key into it, then type the code it shows and select Turn on.

Turning it off and making new backup codes ask for a code first. After five wrong codes, Carya takes no more for 15 minutes.

Log-in alerts

When your account logs in from an IP address it hasn’t used in the last 30 days, Carya emails you. The email says roughly where the log-in came from when Carya can tell. Nothing to do if it was you. If it wasn’t, select Reset your password in the email: that logs your account out everywhere, whoever logged in included. You can turn these emails off in Settings › Emails.

Carya keeps the IP addresses an account logs in from, for this and to stop abuse: each address as it is for 7 days, then only a scrambled form of it that can’t be read back, which Carya deletes at 30 days. The Privacy policy has the details.