Entrada de la bitácora
Accounts and maker profiles
Vahid AslaniSign-up, sign-in and maker profiles at /@username. Some details I cared about: - Signing up never reveals whether an email already has an account. If it does, its owner gets an email instead. - Passwords are hashed with Argon2id. Sessions use short-lived access tokens and a refresh token that changes on every use. Replaying an old one ends that session everywhere, which catches stolen tokens. - Usernames can change, but old addresses keep redirecting, and a freed name is held back for 90 days so nobody can take over someone's old links. - Deleting your account hides your profile at once and erases it for good 30 days later.
