Devices and active sessions

Account, Devices lists every browser and phone currently signed in to your account. It is the answer to "am I still logged in on the studio iPad?" and to the more uncomfortable question of whether anyone else is.

Each row names the device as best we can tell it, for example an iPhone on iOS or Chrome on Windows, with the rough location, when it was last active, and the date it signed in. The device you are reading this on is marked This device and has no sign-out link, because Log out in Account Info already does that job.

Tap Sign out on the row you want gone. Maelo asks you to confirm, telling you which device it is about to sign out, then does it. That device has to log in again from scratch.

If the row was already stale and the device had signed itself out, you get told that instead. Either way the outcome is the one you asked for.

When there is more than one device signed in, Sign out all others appears at the top of the list. It clears every session except the one you are using, so you stay where you are and everything else has to log in again. Use it after selling a phone, leaving a shared computer, or any time you are not sure.

Changing your password does the same thing as a side effect, so if you are already suspicious, change the password and you have done both jobs at once.

Maelo emails you whenever your account is signed in to from a device it does not recognise. That email is the earliest warning you will get, so read it rather than filing it. If the sign-in was you on a new laptop, nothing to do. If it was not, act on it.

Sign-in alerts have no off switch on purpose. The first thing anyone does with a stolen login is silence the warnings, so a security alert you can mute is not a security alert.

Work through these in order. The first two take under a minute and the third is what stops it happening again.

1. 1

   Sign the device out

   Use Sign out all others rather than picking rows one at a time.
2. 2

   Change your password

   In Account Info. Pick something you have not used anywhere else, at least 12 characters.
3. 3

   Turn on two-factor authentication

   Also in Account Info. A password on its own is no longer enough once someone has had a look at your account.

• •Setting up two-factor authentication
• •Exporting your data
• •Getting help