Area riservata
Sign in
The course works with no account at all. Signing in adds a server copy of your progress, so the same record follows you between machines.
What this form does not tell you
- An unknown address and a wrong password produce the same message, and the server hashes a throwaway value for an unknown address so the two take the same time. Either difference would turn this form into a way of asking which addresses have accounts.
- Failures are counted twice over: eight per account and thirty per source address in a quarter of an hour. The second counter is the one that catches credential stuffing, where no single account is ever tried twice.
-
The session arrives as an
HttpOnlycookie, so no script on this page can read it — not even this one. Whether you are signed in is a question only the server can answer.
The reasoning in full is in docs/ACCOUNTS.md and in chapter 15
of the fieldbook.