← All practicals

Recognize your own devices

See how the Lab tells a familiar sign-in from a brand-new one — and why that matters most right after a recovery.

1. 1

   Just by signing in, you already triggered this — your very first login is, by definition, from a device the Lab has never seen.

   Recognition rides a `lab_device` cookie carrying an opaque token; only its SHA-256 is ever stored. No cookie (or an unrecognized one) at login time means login.new_device fires — the raw signal the ATO detector below correlates against a recent recovery.

2. 2

   Open the Devices lab and see this browser listed, labeled from your User-Agent (never the identifying secret) and marked "current".

   The label is presentation only — a learner-friendly summary. The device_hash that actually identifies the row is never returned to the client, same discipline as every hashed-at-rest credential in the Lab.

3. 3

   Revoke the device, then imagine the ATO fingerprint: recover access by email code, then sign in again from an unrecognized device shortly after.

   That sequence — recovery.verified followed shortly by login.new_device for the same user — is the textbook account-takeover pattern in a passwordless system, and it trips a real ITDR detector (ato_new_device_after_recovery) an instructor can triage on the SOC dashboard.