Session Lock
A session lock is a full-screen password prompt that covers tiCrypt until you prove again that you hold the password for your key file. It appears when your decrypted private key has been cleared from memory, when you have been inactive for too long, or when your server session has ended. A session lock is not a logout. The page underneath stays as you left it, your virtual machines keep running, and work that was waiting for your key continues once you unlock.
Why the session lock exists
Your decrypted private key is the most sensitive thing on your computer. While you work, tiCrypt keeps your private key decrypted in memory so it can open files, shares, and drive keys. Anyone who reaches an unattended computer with an unlocked tiCrypt window could use that key. Clearing the key after a period without use, and covering the page after a period without activity, limits how long an unattended window stays useful to someone else.
Locking is cheaper than logging out. A logout reloads the page and discards everything open in it. A lock keeps your tabs and pending work, so a short break costs you one password entry instead of a fresh sign-in.
A locked page does not keep a server session alive forever. If the page stays locked for as long as the inactivity timeout, tiCrypt deletes the server session, and if it stays locked longer still, tiCrypt logs you out. A forgotten locked window therefore ends on its own.
When the session locks
The lock screen appears in four situations. Timeouts are set by your administrator, so the values below are the defaults.
| Trigger | What happens | Default |
|---|---|---|
| Inactivity | You have not been active in tiCrypt for the Session Timeout period. Only three things count as activity: mouse clicks in tiCrypt, file transfers in progress, and input in a VM console window. Typing alone does not count. | 15 minutes |
| Key purged | Your private key has not been used for the Private Key Timeout period, so tiCrypt clears it from memory. The lock screen appears only when something next needs the key. Operations that are running can keep the key in memory longer. | 20 minutes |
| Server session ended | Your server session has expired or is no longer valid. | Not applicable |
| Manual lock | You press Ctrl+Shift+P. tiCrypt clears your key, ends your server session, and locks the page at once. | Not applicable |
Two timers at the bottom of the user menu count down to the first two triggers:
- Go to the Open user menu icon in the toolbar.
- Read the Time until key is purged from memory timer. It reads PURGED once the key has been cleared.
- Read the Time until session is locked timer.
Before you begin
- The lock screen is showing in your tiCrypt window.
- You know the password of the key file you signed in with.
- If your deployment uses multi-factor authentication, you can complete it, because unlocking can require a full sign-in (see What happens next).
Unlock your session
The lock screen reads: "Your private key is no longer in memory. Please enter your password to decrypt it. This ongoing task requires your decrypted private key."
- In the Password field, enter the password of your key file. A caps-lock icon appears in the field if Caps Lock is on.
- Click Unlock, or press Enter.
The lock screen closes and tiCrypt shows the page as you left it. Any task that was waiting for your key, such as a download or a file preview, continues. The user menu timers start again.
To leave instead, click Log Out. tiCrypt ends your session and returns to the login page.
The lock screen also shows:
- The password countdown: the password field clears itself after 10 seconds without typing. While you pause, the hint reads "Password will be cleared in Ns", and when it clears, a pop-up reads "Password scrubbed from memory".
- The logout countdown: "You will be logged out automatically in" followed by the time left. By default this is 60 minutes from the moment the page locked.
- Your last login: the same line as on the login page, for example "Last logged in 2 hours ago", or "Last failed login: ..." with the number of failed attempts.
While the page is locked, the task tray is hidden. It comes back when you unlock.
What happens next
If your server session is still valid, unlocking only decrypts your private key again. Nothing else changes.
If your server session has ended, unlocking signs you in again in full. This happens when the page stayed locked for as long as the Session Timeout (15 minutes by default), when you locked it with Ctrl+Shift+P, or when the server session expired. A full sign-in can ask for multi-factor authentication:
- A panel reads "Multi-factor authentication opened in another window" and "Switch to the newly opened window to complete the authentication process."
- Complete the sign-in in the window that opened.
- If you cannot find that window, click Re-open MFA tab. A pop-up reads "Opened another MFA tab. Look for it in all Browser windows."
- When the provider window shows "The MFA process has finished." it closes on its own. If it does not, close it.
If your deployment requires more than one factor, the windows open one after another. If your deployment caches multi-factor tokens, tiCrypt reuses a cached token that has more than five minutes left and does not open a window.
If you do not unlock, tiCrypt logs you out when the logout countdown on the lock screen reaches zero.
After 10 wrong passwords in a row, tiCrypt removes the key file it cached on this computer and logs you out. The count is shared with the login page and resets when you sign in successfully. To sign in again, load your key file. See Private Keys.
Errors and resolutions
| Message | What it means | What to do |
|---|---|---|
| Incorrect password, try again. | The password does not decrypt your key. | Re-enter the password of the key file you signed in with. |
| Login failed, try again. | Unlocking needed a full sign-in, and the sign-in failed. | Check the password, complete any multi-factor window, and try again. |
| You must enter the password to decrypt your key | The password field is empty. | Enter your password. |
| You are back on the login page | The logout countdown ended, you clicked Log Out, or you entered 10 wrong passwords. | Sign in again. After 10 wrong passwords, load your key file first. |