Team and account security
Sign-in, two-factor, invitations, API keys, audit log.
Sign-in without a password #
NODE64 sends a sign-in link to your email address. It is valid briefly and usable once. There is no password to steal, reuse or guess.
The price: whoever has access to your mailbox has access to your account. Hence the next section.
Two-factor authentication #
Under Settings → Security you set up TOTP – with any authenticator app. After that NODE64 asks for the six-digit code in addition to the sign-in link.
During setup you receive recovery codes. Print them or put them in your password manager. Without your second device and without the codes we cannot get into your account either – that is the point of encryption.
As the account owner you can make 2FA mandatory for all members.
Team #
Invite members by email. Two roles:
| Role | May |
|---|---|
| Owner | everything: devices, rules, team, API keys, delete the account |
| Member | see findings and devices, edit them depending on group permissions |
Device groups control who sees which systems and who may change them. A member without write permission can read findings but not accept or postpone them – a decision about a risk is a change.
A user can be a member of several accounts and switch between them at the top right.
API keys #
Under Settings → API you create keys with fixed permissions. A key is shown once – after that only its prefix. We store it as a hash only; if you lose it, create a new one.
Keys can be revoked at any time. See API.
Check from outside #
The agent sees what listens on a system. It does not see what actually gets through router, port forwarding and provider firewall. Comparing the two lists finds the forward nobody remembers — and from the inside there is no other way to find it.
Three results per port:
- open inside, open outside — expected, if the service is meant to be public.
- open inside, closed outside — good. That is exactly how an internal service should look.
- open outside, nothing inside — the interesting case. Usually a port forward pointing at a different device on the network: one nobody monitors and nobody updates.
A fourth result reads no answer. That is not a middle ground but the honest statement that we do not know: a firewall that drops packets rather than rejecting them looks exactly like a congested network. Reporting that case as "closed" would be an all-clear with no basis.
What is checked — and what is not #
The ports that listen inside, plus a small fixed list of the usual suspects (22, 80, 443, 3306, 5432, 6379, 9200, 27017). No full port scan across 65535 ports: that is a different tool with different legal questions, and it does not answer the question any better.
The conditions, and why they exist #
Opening a connection to someone else's address is unproblematic as long as the address is your own — and becomes the opposite as soon as it is not. Therefore:
- No input field for the address. Only the public address from which a device of this account sent a validly authenticated report is checked. A typed-in address would be a claim; this one is proof.
- The address must be fresh (at most 30 minutes old). Connections get a new address on reconnect — a four-hour-old one may belong to someone else by now. So start the check shortly after a report.
- Shared connections are excluded. If devices from different accounts report from the same public address, a shared connection sits behind it (carrier-grade NAT). Then the address belongs to no single customer, and nobody can consent for it.
- Every run is logged — including the refused one, with address, time and the account that triggered it. Turning the feature on is logged as well.
Only the account owner can switch this on, under Settings › Security. The default is off: every other switch there only decides what NODE64 does with data it already has; this one opens a connection, and that is a different kind of decision.
Audit log #
Every security-relevant action lands in the audit log: sign-ins, changed addresses, 2FA on and off, invitations, deleted devices, created and revoked keys, accepted risks, changes to alert rules. With timestamp, actor and IP address, filterable by action.
The log cannot be deleted. It is the record when somebody asks "who did that?".
Deleting the account #
Under Settings → Account you can export all data as an archive and delete the account. Deleting means deleting: devices, findings, uploads, measurement results. The operation cannot be undone, and we keep nothing back.