Improved session management
Asking for improvements to the existing "Session management" under
"Security and privacy"
1. Capitalize the Second word: "Session management" -> "Session Management"
2. Sort by type: rather than by date
a. Mail, Calendar, Drive, VPN, Pass
b. web, Windows, macOS, GNU/Linux, Android, iOS
c. Also by date: Ascending and Descending like when sorting emails
3. Give names to each session: Mullvad VPN does this well
The Problem: In "Session management" each entry does not clearly
correspond to a session due to only the "App" and "Date" being
listed. This becomes a problem when there are many sessions.
The Solution: Give names corresponding to each session so that
users can confirm and differentiate each session.
Improving 2 and 3 will improve security for users through easier session management.
-
Positron
commented
Names from sessions in the Security tab would be welcome. It's hard to tell the sessions apart. I'd envision a text input at the top of any session that could be named by the user, making it difficult for an unauthorized user to come up with a matching naming convention.
-
Myomer
commented
The Proton Pass browser extension shows up as "Proton Account for Web." It'd be great if this was fixed. The Android apps are all identified individually which is a big help. But everything else is "Proton Account for Web" which isn't useful.
Seconded to everyone else's comments that it would be a big help if we could add custom identifier to each session.
-
Jim
commented
If a user could name or group sessions, that would help not to lose track of which sessions were actually their own. I think they should have more recognizable attributes visible to the user to make it possible to spot malicious/unauthorized logins that would otherwise not stick out.
Additionally, each session could be tagged as "known"/secure/confirmed. I guess that how trust should be allowed to propagate between sessions needs a concept too.
A threat actor in this scenario would then no longer be able to retain access to a target's account via a permanent session if the attacker has no way of repeatedly producing 2FA authentication responses.
Maybe visually grouping them could further help, not giving up on keeping an eye on active session management. For example, my phone has 5 apps (Mail, VPN, Calendar, Drive, Wallet, ...) which each have their own session in the session management settings section. If users could add a free text note to each session, that would go a long way already. The only way of grouping them otherwise seems to be logging in at the same date and recording the count of sessions. At least thats what I have tried. My use-case is probably not that common (grapheneos with multiple user profiles->multiplied session count->lack of ways to differentiate sessions), but the naming/tagging could help with accruing a long list of so many sessions that a new unknown session can not be spotted.
It is entirely possible that I am a bit too paranoid, or there are reasons against such functionality?
-
FrankenInternet
commented
This would make it easier to know what device what session is on, and when to revoke it when the device is no longer in use rather than playing a session guessing game.
-
Z
commented
This is honestly a top 3 feature for me. I (unfortunately) have a decent amount of devices that I need to use my Proton account on, and it would be incredible to be able to add custom labels to the sessions so I know what is what.
-
Wizard4_Uncorrupt2
commented
Especially the names/labels for each session. For people with multiple devices, instead of just seeing, "Proton VPN for GNU/Linux" multiple times, they could be additionally labelled as "Desktop" and "Laptop" sessions.
-
Graz Demov
commented
Basically, as the title says, being able to add a custom name to each session, for better organization and overview.
e.G.
Proton Pass for iOS: "Andreas iPhone 12 Pro"