A one-time code, also called a one-time password or OTP, works exactly once and expires after a short time. CIRO NOISE uses it instead of a password: you enter your email address, get a six-digit code in your inbox and are signed in once you type it in.
The advantage: there's no password to remember, change regularly or protect from phishing. Whoever has your inbox can sign in, and you protect your inbox anyway.
How the one-time code works in CIRO NOISE
For sign-in, the one-time code is valid for 10 minutes. After five wrong attempts it's used up and you request a new one. The same email also contains a sign-in link valid for 15 minutes, in case you'd rather click than type.
For particularly sensitive steps, CIRO NOISE sends a separate one-time code: to reveal passwords in the vault, to create a one-time share, to delete the organization and to delete your account. These codes are also valid for 10 minutes and five attempts.
Security
Every code is tied to its purpose. A vault code doesn't sign anyone in, and a deletion code only works for the exact organization it was sent for. CIRO NOISE stores the codes for the vault and for deletions only as an irreversible fingerprint, so a look into the database reveals no valid code.
An everyday example
Deniz signs in on his new laptop in the morning. He enters his email address, opens his inbox and types in the code. Later he needs the hosting password and gets a second code that unlocks the vault for an hour.