🔐 Trusted devices
In a passwordless system the weak link shifts to the recovery flow — an email code that only proves you control a mailbox right now. Recognizing the devices you actually sign in from turns an unfamiliar sign-in into a real signal, especially right after a recovery.
Recognition rides an opaque lab_device cookie — never the
User-Agent, which is attacker-controlled and not a secret. Only the cookie's SHA-256 is ever
stored; the label below is a best-effort, non-secret summary of your browser, purely so you can
recognize the row. A sign-in presenting no cookie (or an unrecognized one) is a new device — and if it lands shortly after a recovery, ITDR raises a real ato_new_device_after_recovery alert (see the SOC dashboard).
Revoking a device below just removes the trust row — its next sign-in is treated as new again.