Crew Scheduling Auto-Login Information

Reading this informative page is not necessary to successfully use the Auto-Login feature. This page is provided so that you will know what to expect of the behavior of auto-login feature, or to satisfy technical curiosity. The features of auto-login are as follows:

If you are satisfied with that information, you can log in, whether or not you choose to use the auto-login feature.

When you use the Auto-Login feature of the scheduling system, a "cookie" called AutoID is sent to your computer's browser which contains two pieces of information - one is a small integer that identifies you to the system, and the other is a cryptographic "hash" of your password.

The hash of your password is very sophisticated. The hash is based on a random "salt" value which is stored in the server's database, but which is never sent out on the net. The hash is also non-reversible. That is, there is no (known) method of regenerating the clear text password from the hash, even if the "salt" value were known. The only way to use the hash is to re-encrypt the original password and compare the results. This results in pretty slick operation of the auto-login. Changing the "salt" value will generate a different hash without changing your password.

When you come to the system, your browser will send any cookies associated with it to the server. The server will see the AutoID cookie and re-encrypt your password with the stored "salt" value. If the cookie contents match the the re-encrypted password, you are given a "free pass" into the system.

To eliminate issues of "left over" information on old computers or computers to which you no longer have access, the "cookie" will expire in 90 days. This date is "pushed out" each time you use the auto-login feature, but if you go away from the system for more than 90 days, your auto-login will have expired. To further avoid "left over" information, a new "salt" value is chosen each time you create a new auto-login. Therefore, if you lose access to a computer for any reason, creating a new auto-login from another computer or profile will generate a new "salt" value, invalidating the old auto-login value.

A side-effect of this is that you can only have auto-login active on one computer and browser (and profile) at a time. If you use individual profiles on your computer, each profile can have a different auto-login for a different user of the scheduling system. You can't, however, have an auto-login to the same scheduling system user on two different profiles or in two different browers (e.g. Netscape Gecko and MS Internet Explorer). This is because the different browsers do not share their cookies. Each time you create a new auto-login, it will invalidate any previous auto-logins for that user of the scheduling system, whether on a different computer, profile, or just a different browser.

Logging in without using the auto-login feature will not generate a new salt value. Therefore, you may have "auto-login" set at home but still use the system at work without invalidating your home "auto-login." It is not, however, currently possible to have auto-login set on two different computers or two different profiles.

Of course, you may use your broswer's cookie manager to delete the AutoID cookie at any time. Each time you auto-login to the system, or log out of the system with auto-login active, you will also be given the option of disabling it.

The system does not distinguish between the lack of an AutoID cookie, an "erased" AutoID cookie, or an invalid AutoID cookie. If you come back to a computer that has an "old" AutoID cookie, you will not be locked out because of the invalid information - it will simply be ignored.

The system has always told you your last login time when you log in. If you are concerned about the security of the auto-login feature, you may wish to take note of this time.

When you log in, you may choose to use the auto-login feature if you have cookies enabled in your browser.