Device-bound sign-in, "Stay signed in" and connected devices: how the control panel protects your account

What happens when you sign in

When you type a username and password and sign in to the control panel, the server doesn't ask for the password again with every click. Instead, it gives the browser a temporary "entry pass", and the browser shows it with every request. This is what's called a session. The pass is stored in the browser as a cookie — a small file the browser keeps for the website.

The convenience is clear: you sign in once and get to work. But there's also a question: what if this pass ends up in a stranger's hands? If the pass alone is enough, whoever holds it gets into the account without knowing the password.

A sign-in tied to the device

In the Kesher control panel, the sign-in is tied to the device you signed in from. A session created in one browser works only in that browser. Even if the pass itself is copied to another computer, it won't open the account there.

What does this mean for you day to day? Almost nothing, and that's the point. You sign in as usual and work as usual. The protection works in the background, with no extra code and no extra step.

And what shouldn't you expect from it? It doesn't replace a good password, and it doesn't protect someone who gave away the password itself over the phone. Anyone who knows the password can log in from a device of their own — which is why there is also the "Connected devices" panel, where you see every such login and disconnect it.

A time-limited session

A session that stays open forever is a session someone else might use: a computer left on in the office, a tablet forgotten in the dining hall. That's why the control panel session is time-limited: after a period without activity it closes, and you need to sign in again.

This can be annoying sometimes, especially when you come back to your desk after a break. But it's the price of a computer you can walk away from without worry. If you work from your own personal computer and don't want to type a password every time, you can choose to stay signed in.

"Stay signed in" — what exactly is saved

When you choose "Stay signed in" (Remember me), the browser stores a token that lets you return to the control panel without typing the password again. Under Kesher's privacy policy, the password itself is not stored in plain text: only an encrypted token is stored in the browser.

This token is tied to the device too. It works in the browser where it was created, and nowhere else.

When to use it, and when not to?

• Yes — on your own personal computer, which has a screen lock and that no one else works on.
• No — on a shared computer: a teachers' room, a library, a front-desk station, a family member's computer.
• No — on a phone with no screen lock.

And if you chose to stay signed in and suddenly you're not sure — signing out of all devices also cancels all of your user's "Stay signed in" tokens, everywhere.

Up to three devices, all in plain sight

You can be logged in to the dashboard with the same user on up to three devices at once: for example the office computer, the home computer and the phone. That is enough for normal work, and it prevents a situation where one user is open in ten places nobody remembers anymore. When you log in from a fourth device, the device that has gone unused the longest is disconnected.

The control panel toolbar has a Connected Devices button. Clicking it opens a small panel with:

• all the devices where your user is signed in right now;
• the IP address of each one;
• a mark on the device you're looking from right now;
• a Disconnect button next to every other device;
• And at the bottom — the Sign out of all addresses button, which disconnects all the devices at once.

Signing out of all devices

Signing out of all devices ends all of the user's sessions, and also all the "Stay signed in" tokens, including on the device you clicked from. After that, you sign in again only on the devices you want.

When do you use this?

• You forgot to sign out on a shared computer.
• Your phone was lost or stolen.
• An employee who used the same computer no longer works for you.
• You're worried that someone saw or heard the password.

Completing a password reset also disconnects all previous sessions. So if you changed your password because you were worried it had leaked, you don't need to remember to sign out separately: whatever was open with the old password is closed.

Layers that work together

No single protection is enough on its own. The strength is in the layers, each one covering what the others don't:

• Password — what you know.
• Device-bound sign-in — an open session doesn't move to another device.
• Time-limited session — a computer left signed in closes the session on its own.
• Connected devices — you see every sign-in and disconnect anything you don't recognize.
• IP address restriction on extensions — on the extension card you can set which addresses a device may connect to the line from, so that even someone who obtained the line password cannot connect a phone from outside.
• Permissions for each user — even someone who gets in sees and does only what that user is allowed to.

A user for each person, not one user for the whole office

The most common mistake is one user that the whole team signs in with. When everyone uses the same name and the same password, you can't tell who did what, you can't give different permissions, and three devices are no longer enough. And when an employee leaves, you have to change the password for everyone.

The solution is simple: on the Users screen, create a user for each person. That way everyone has their own devices and their own permissions, and you can remove a user on the day that person leaves, without touching the others.

Example: a secretary who changed roles

A secretary at a nonprofit moved to a different role and is no longer supposed to handle the phones. She was signed in to the control panel from the office computer and from her personal phone.

The manager updates her permissions, or removes her user on the Users screen. Before switching roles, she herself clicked sign out of all devices — so there's no open session on her personal phone either. No one had to change a shared password, and no one else was signed out.

Cookies: what the control panel stores in the browser

The word "cookies" sometimes raises suspicion, because it brings tracking and ads to mind. In the control panel, cookies are used mainly for one thing: remembering that you signed in, so you don't have to type a password with every click.

• The session cookie — the temporary entry pass. Without it you can't work in the control panel. It's tied to the device and limited in time.
• The "Stay signed in" token — only if you chose it. It's encrypted, and it's also tied to the device.

Under Kesher's privacy policy, browsing statistics are collected only on the public website and only if you agreed — not in the control panel, not on the sign-in page and not on payment pages. In other words, what you do in the control panel isn't sent to website analytics tools.

What happens when you delete cookies

If you delete the cookies in your browser, or use a private browsing window, the session will close and you'll need to sign in again. That's not damage and not a malfunction: the sign-in simply isn't in the browser anymore.

And the other way around: if you work on a shared computer, deleting cookies at the end of the day, or working in a private window, is a good way to make sure no open session is left behind you. Even better, click Sign Out before you get up.

When a computer changes hands

A computer that passes to another employee, is sent for repair or is sold may carry an open session or a "Stay signed in" token with it. Before you hand it over: sign out of the control panel, delete the browsing data in the browser, and to be on the safe side, sign out of all devices from another device.

Working remotely without leaving gaps open

Many managers sign in to the control panel from home, from their phone or from another branch. That's perfectly fine, and it's exactly what a cloud PBX makes possible. A few simple habits keep it safe:

• A personal device, not a public one. A computer in a shul or a library is not the place to sign in to the organization's account.
• A screen lock on your phone. A phone without a lock, with an open session, is a key to the account.
• Check the connected devices. Anyone who logs in from several places sees all of them in the "Connected devices" panel, and disconnects whatever is no longer in use.
• Limited permissions for those who sign in from outside. Someone who only needs to listen to messages doesn't need permission to change routing.

A two-minute monthly check

Once a month, anyone who manages the PBX can do a short check:

1. Open "Connected Devices" and make sure you recognize every device on the list.
2. Go over the Users screen: is there a user for someone who no longer works at the organization?
3. Check that users have only the permissions they really need.
4. For extensions that have an IP address restriction — make sure the address is still correct, for example after changing the office internet provider.

That's it. Two minutes, and the account stays clean.