Sign-in Protection & Spam Checks

How SphereHarness keeps accounts and forms safe: signing the desktop agent in through your browser, the person check on every website form, the lock after too many wrong passwords, and the limits on how often a form can be sent.

Signing the desktop agent in through your browser

The desktop agent can sign in without ever seeing your password:

1. In the agent’s sign-in card press Sign in with your browser. Your browser opens sphereharness.io/device, and the agent shows a code such as BCDF-GHJK.
2. Check that the code in the browser is the code the agent shows. If you did not start a sign-in yourself, do not continue.
3. Sign in on the website as usual (password or e-mail code). The page shows the program and the PC that asked, and when.
4. Press Approve this device. The agent is signed in within a few seconds; you can close the browser tab.

The code works once and expires after 10 minutes. Pressing This was not me, or letting it expire, leaves the agent signed out; start again from the agent. Because the sign-in happens on the website, it gets the same person check and lockout as every other website sign-in.

The person check on website forms (Cloudflare Turnstile)

Every form on sphereharness.io that someone could fill in automatically carries a small verification box from Cloudflare Turnstile: sign-up, the three portal sign-ins (and the e-mail code), forgot and reset password, contact, the reseller application and agreement, invitations, e-mail confirmation, the device sign-in page, and the forum, marketplace, report and takedown forms.

• Usually it ticks itself within a second or two. Sometimes it asks you to click a checkbox. There is no picture puzzle.
• The send button stays disabled until the check has passed. A check is valid for 5 minutes; on a page left open longer the box resets and checks again.
• If the box says it could not load, reload the page. Content blockers and some strict corporate proxies block challenges.cloudflare.com; allow it for sphereharness.io.
• Our server confirms every check with Cloudflare when you send the form. If Cloudflare cannot be reached, the form is refused with “We could not confirm you are a person — please try again”; nothing is sent without a confirmed check.

Cloudflare sees your IP address and technical details of your browser to make the check; it does not receive what you type into the form. See the privacy policy.

The desktop agent and the CAD add-ins do not show the box: they talk to the server’s programming interface, which is protected by the limits below instead.

Too many wrong passwords: the sign-in lock

• 10 wrong passwords for one address within 15 minutes lock sign-in with a password for that address for 15 minutes. Each further lock within 24 hours lasts twice as long, up to 4 hours.
• 30 wrong passwords from one network within 15 minutes lock password sign-in from that network, whatever the addresses.
• While a lock lasts the password is not checked at all, so even the right password is refused. The answer is the same whether or not the address has an account.
• The way out is the e-mail code: choose Email me a code instead (see Signing In & Out). A successful sign-in clears the wrong attempts for your address. A website administrator can also lift a lock.

This applies to the desktop agent’s password sign-in and to the admin, organisation and reseller portal sign-ins.

How often a form can be sent

Over a limit you see “Too many requests” and how long to wait. A forgot-password request over its limit still says the e-mail was sent, so the page cannot be used to find out who has an account.

Accounts created from an add-in must confirm their e-mail address before they can be used: open the link in the e-mail and press Confirm my email, then sign in.

See also

• Signing In & Out
• The community forum
• Privacy policy: Cloudflare Turnstile