Device Password / App Password / how to delete expired / old entries

(NC 20 on OpenSuse 15.2, updated in a row for years, starting from Owncloud)

Hi all,

my /settings/user/security screen looks different from the screen described in the doc pages https://docs.nextcloud.com/server/latest/user_manual/en/session_management.html?highlight=token#managing-devices

Doc pages are showing separate sections for “devices” and “sessions”, whereas my Nextcloud shows just one section “Devices & Sessions”.

Plus, my main issue, sessions seems never to be disapperaring, I’ve hundreds of sessions for e.g. mobile devices, which even doesn’t exist anymore, physically.

As I want to switch all relevant accounts to 2FA, I’m in the process of defining device passwords for all needed apps/devices, like DAVx5, Nextcloud Talk on mobiles, etc.

For this, a “meaningful” overview of devices and sessions, without the old garbage, would be more than cool. Esp. if I really want to revoke anything.

Just an extract of the hundreds of records:


Unfortunately, If I perform a “delete device”, only the current record is deleted :frowning:

Any hints would be great!

1 Like

Hi,
any solution yet? I have the same problem and I can’t find a suitable way to get rid of all these unnecessary entries…
I really appreciate your answer!
Best regards
Sven

Yes please! This is like how any social network becomes a memorial graveyard. To the developers, it’s easy, 2-3 app passwords, the process works great! Release! Users after a few years, drowning in cruft.

App passwords should be reusable, there is zero security value in enforcing single use. Encourage it, sure, but the premise underlying the belief that one device: one password is more secure is as flawed as forcing users to change their login passwords on a schedule: there’s some underlying logic, but in practice it fails.

In this case I generally take care to copy out an app pass phrase, save it in the password manager, and then use it to set up logical groupings - every app on a phone gets the same one, then deleting that one kills all the apps on that phone. Or all phones get one, all laptops get another, something logical and manageable like that.

Unfortunately, I didn’t save the QR code and my app manager doesn’t have a secure way of encrypting the image, so even with careful management of this nice idea but flawed implementation, my list too has grown to “tedious to scroll through” but not quite to “crash the browser” yet.

1 Like