Approved devices

With the rule Approved devices only, members get into a team only from devices the team approved, and a vault’s certificate authority signs certificates only for those devices. ZestSSH Cloud and every device check it.

A device is approved from a device that is approved already. Both screens show three words, and the person at the approved device approves only if they match.

How ZestSSH knows a device

Each device makes a signing key of its own for your account when it first needs one. The private half stays in the system’s secure storage on that device. It is never synced and is in no backup.
The team’s signed record lists the public half of each approved device, member by member. Every device checks that list for itself. The record holds no device names and no times.
A device tells ZestSSH Cloud which sign-in is its own, by signing the sign-in’s id with its key. ZestSSH Cloud then holds each request to the rule by the device it comes from. A device says this only for an account that is in a team.
People tell devices apart by a short code made from the key, such as 7F3A-09C2, the same on every screen. The code protects nothing: what is approved or removed is always the whole key.

If the key kept on a device is lost, the device counts as a new one and has to be approved again.

Who approves whose device

Approver	May approve and remove
You	Your own devices
An owner	Anyone’s devices
An admin	Devices of members below admin

The approver always works from an approved device of their own. The one exception is an owner’s very first device, which approves itself, and only while the rule is off. With the rule on, a new member’s first device is approved by an owner or an admin above them.

Each approval and each removal is an entry in the team’s signed record, signed by the device that made it.

Turn the rule on

You need this device approved, and at least two approved devices among the owners, so that losing one does not lock the owners out.

Open Rules. On a computer: Team in the rail, then Rules. On a phone: More, the team under Team, then Rules.
Under Approved devices only, the row says what is missing:
- Approve this device first. An owner’s first device approves itself. Choose Approve this device.
- This device is not approved yet. Ask from here, and approve on a device that is. Choose Ask to be approved.
- One more owner device has to be approved first, so that losing this one does not lock you out. On that device, open Team and Members, pick your own name, and ask to be approved. Then approve it from this device.
Once the switch can be turned on, the row may say how many members have no approved device yet. They will be held back until one is approved, and they ask from their own devices.
Turn on Approved devices only. The row warns: Keep at least two owner devices approved. If every approved device of every owner is lost, nobody can manage this team again, and nobody can undo that, ZestSSH included.
Choose Save rules. If ZestSSH asks you to Confirm it’s you, choose Sign in again.

While the rule is on, the record refuses any change that would leave the owners with no approved device at all.

Ask to be approved

On the device that is not approved:

Choose Ask to be approved. It is on the team’s banner, which says This device is not approved for this team., and on your own row under Members, in Approved devices.
The window says: An approved device has to say yes: one of your own, or one of an owner or admin. It shows This device: and its code.
Wait for an answer. The request lasts ten minutes. Closing the window before the device is approved takes the request back.
When someone answers, three words appear. Read them to the person approving, or show them. They approve only if their screen shows the same words, in the same order.
You see This device is approved for the team. What the team holds starts to arrive.

Asking again replaces the request this device made before. If you see This sign-in cannot be approved. Sign out and sign in again on this device, then ask again., do that.

Approve a device

On an approved device of someone who may approve it:

Open Team. On the Overview, under Needs attention, the request shows as “Robin’s device asks to be approved”, or Another device of yours asks to be approved. A notice says the same: A device asks to be approved in the team.
Choose Review. Go on only if the person is with you or on a call with you, and is the one asking. For your own device, only if it is in front of you.
Choose Continue, and wait for the other device to show its words.
Compare the three words with the other screen, in order. The window also shows The device that asks: and its code.
If they are the same, choose They match, approve. If ZestSSH asks you to Confirm it’s you, choose Sign in again. You see Approved. The device gets in now.
If they differ, choose They do not match. Nothing is approved. If you did not expect this, tell an owner: someone may have tried to get another device approved.

Only one device answers a request. If someone else got there first you see Someone else is already answering this request.

The three words

The words come from the BIP-39 English list of 2,048 words, so three words carry 33 bits.

The asking device commits to its key and a random value, without showing either.
The approving device answers with a random value of its own.
Only then does the asking device show its key and its value, which must match what it committed to.
Both devices work the words out from the team, the member, the commitment, both random values and the key.

Each side picks before it sees the other’s value. So someone in between who wants another key approved, ZestSSH Cloud included, gets one guess in 2^33, about one in 8.6 billion, at making the words match. The words also cover the team and the member, so a request passed off as someone else’s, or as another team’s, shows other words.

If what the asking device shows is not what it committed to, the request ends at once: This request was changed on its way here, so it was ended. Nothing was approved. Do not approve this device until an owner has looked into it.

A request answered on a device that has since closed ZestSSH cannot be finished there. Decline it, and ask again on the other device.

Remove a device

Open Members, pick the member (or yourself), then choose Approved devices.
Choose Remove next to the device’s code. The window asks Remove device and the code; confirm with Remove.

Removing needs a sign-in from the last ten minutes, unless a device takes back its own approval.

While the rule is on, a removed device stops syncing and drops what it holds of the team the next time it reaches ZestSSH Cloud. Its person sees, for example, This device was removed from Northwind Ops. What it held of it is gone from this device. The device can ask to be approved again.

A device that is not approved

While the rule is on, a device that was never approved:

keeps what it already holds, and that still works, as with any rule a member falls short of (see Team rules);
gets nothing new from the team, and sends nothing to it;
cannot read the team’s record or change its rules, an owner’s device included;
can still ask to be approved, and its person can still leave the team.

Signing in again changes nothing. Only an approval does.

Turn the rule off

On the Rules page, from an approved device, turn Approved devices only off and choose Save rules.

Limits

Losing every owner device. If every approved device of every owner is lost while the rule is on, nobody can manage the team again. Nobody can undo that, ZestSSH included. Keep at least two owner devices approved.
Up to 20 approved devices per member.
Ten minutes for each request, and one open request per sign-in.
Certificates. With the rule on, an owner’s device signs a certificate request only for a device the record lists for that member, and ZestSSH Cloud refuses others. See Certificate authority.
Not the same as Approve a new device. In your account’s Devices, Approve a new device sets up sync on a new device of yours without typing your sync password there. It also compares three words, but it approves nothing in a team. See Signed-in devices.
No Business needed for this rule.

Next steps

Team rules: every rule a team can set.
Company sign-in (SSO): members sign in with their work accounts.
Signed-in devices: the devices signed in to your account.