Signing in: a time, repeated, and what a run of times suggests
Signing in tells the server that the person holding this passphrase is here now. The word doing the work in that sentence is "now".
The market server · Whoever runs the platform · Anyone who later obtains the server
Authentication is a comparison. You supply a name and a passphrase, the server checks them against what it holds, and if they agree it starts treating your requests as belonging to that account. The comparison itself is uninteresting. What is interesting is that it happened at a particular moment, and that it will happen again.
What one sign-in is
One sign-in is an event with three parts: which account, at what time, and whether it succeeded. A failed attempt is an event too, and often a more interesting one than a successful one, because a run of failures followed by a success describes someone struggling to recall something.
On its own this is thin. It says an account was used. It does not say by whom, from where, or for what. Every card in this section is careful about the difference between a fact the server holds and an inference somebody might draw from it, and here the fact is very small.
What a sequence of times supports
Repetition is what turns a thin fact into a thick one. Sign in a hundred times over some months and the collection of timestamps has a shape. Two inferences are commonly available from that shape, and both are weaker than they sound.
The first is a rough pattern of waking hours. People tend to be present at a keyboard during a band of the day and absent during another band. If the events cluster in one part of the clock and vanish from another, that gap is doing the talking. It suggests when this person is typically asleep, at work, or otherwise occupied.
The second is a rough sense of time zone, which is really the same observation stated differently. If the quiet band lines up with the small hours somewhere, that somewhere is a guess about a region, not a place. It is a guess spanning entire continents at the same longitude, and it is wrong for anyone who works nights, travels, keeps irregular hours, or shares the account.
| What is held | What it supports |
|---|---|
| One sign-in event | An account was used at a moment. |
| A week of events | Very little. A handful of points is noise. |
| Months of events | A band of the clock when activity happens, and a band when it does not. |
| The same, compared to another account | Whether two accounts are active in the same band or in opposite ones. Similarity is not identity. |
What it does not support
A time pattern is not a location. A quiet band consistent with night somewhere is consistent with a very large number of somewheres, and equally consistent with a person on a night shift in the opposite hemisphere. It is not a name. It is not an address. It cannot be turned into either by having more of it, because more of the same kind of data narrows the band and never crosses to a different category.
It is also not proof that one person is behind the account. An account used by two people in different rhythms produces a pattern that describes neither of them, which is a general problem with reading behaviour off a shared login and one of the reasons lending the machine is a separate card.
Session cookies, and what they settle
Once you are signed in, the server needs some way to recognise the next request as yours. That is normally a session cookie: a value handed to your browser and sent back with each subsequent request until it expires or you sign out. It is a bookkeeping token, not an identity document.
A session cookie held only for the session means the browser discards it when it closes. What that does is prevent the token from sitting on the disk afterwards, so a later look at the machine does not find a value that would have kept you signed in. That is a real gain, and it is a gain against your own device rather than against the market. What lands on disk in general is the subject of what lands on the disk.
What a session cookie does not do is limit what the server receives during the session. While the session is open, every request carries the token and is therefore attributable to the account. Closing the browser ends the token, not the record of what was requested while it existed. Requesting a new circuit does not help here either, which is why asking for a new circuit is filed as a network-level action and not an account-level one.
What changes the answer
4 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.
- Fewer, longer sessionsA pattern is built from the count and spacing of events. Signing in less often produces fewer points to plot. It does not change what happens during a session, and a long session has its own shape, discussed in how long the session runs.
- Signing out rather than closing the tabAn explicit sign-out ends the session at a moment you chose. Abandoning a tab leaves the session to expire on the server's schedule. Neither removes the record of the session that already happened.
- Not letting the browser remember the passphraseA stored credential is a copy on your disk and it makes a habitual sign-in effortless, which usually means more of them. Typing it each time removes the copy. It has no effect on the server-side record.
- Irregular hours, honestly assessedA pattern only exists if there is one. If your presence is genuinely scattered, the timestamps say correspondingly less. This is a description of a situation rather than a technique, and deliberately faking a rhythm is usually more visible than not having one.
What this card is not
This is not a claim that Awazon Market keeps a sign-in history. It is a description of what any authenticating server necessarily observes at the moment of authentication.