Give participants a secure key, not an account

Asking a research participant to create an account with an email address, remember a password and register with an identity provider makes participation harder and collects more personal data than needed. In EnaResearch, organization users sign in with Logto; participants have no organization account. Participant access starts with the code and activation card the researcher hands over.

The code works like a user name, not a password. That is why the code alone never signs anyone in: web sign-in asks for the PIN the participant set during activation, and in the mobile app the activation turns into a device-bound session.

Each person has a single active participant code at a time. The code is 6 characters long, generated with a secure random source from an alphabet that leaves out easily confused letters, and kept unique across the organization by a database constraint. Codes are not sequential; one code does not reveal another. A revoked code is never used again.

Look-alike characters are corrected on input: the letter O is read as zero, I and L as one. Researchers can rotate or revoke a code; both actions invalidate all of the participant’s sessions and pending activation keys.

From the admin panel the researcher prints an activation card for the participant. The card carries a QR code, the organization code, the participant code and the activation key; the organization’s uploaded QR logo sits in the center of the QR code. It contains no identity details such as name, date of birth or person identifier. The activation key has 12 characters, can be used once and is valid for 14 days; issuing a new key invalidates the previous one. The key and QR code are shown only once.

The key is stored in the database only as a SHA-256 hash. In the activation link the key travels in the # fragment of the address, which is never sent to the server or its logs, and the page removes it from the address bar after reading it. During activation the participant sets a 6-digit PIN.

Activation starts a session that covers all of the person’s studies. Therefore, if the person is also active in another study whose team the researcher is not on, only the organization owner can issue the key; the same rule applies to rotating and revoking the code. A researcher on the teams of both studies can do this.

Signing in to the participant web area takes the code and the PIN. The PIN is stored hashed with scrypt; sequential or single-digit PINs such as 123456 are not accepted. A wrong code and a wrong PIN get the same answer, and the same computation runs for an unknown code, so response time does not reveal whether a code exists.

After 5 failed attempts per code from one IP address a 15-minute lock applies, after 50 per code from all addresses a 24-hour lock; each IP address is limited to 30 failed attempts per hour. If the service that tracks lockouts is unavailable, sign-in stays closed rather than open. Every attempt is written to the audit trail as an access event; participant codes, PINs and session tokens never are.

Access tokens are valid for 1 hour; a web session lasts 7 days and a mobile device session 90 days, extended with use. The refresh token changes on every use; if a used token comes back, the session is ended. Tokens are stored in the database only as SHA-256 hashes. On the web they live in httpOnly, SameSite=Strict cookies limited to the participant area’s path, out of reach of page JavaScript.

The participant web area (/p on the organization’s address) shows the participant’s studies, pseudonym and participation status, connected data sources and last sync time, a daily summary of the last 7 days per metric, open sessions and PIN change. Individual measurements and identity details are not shown. Participants and researchers can end open sessions remotely; changing the PIN ends the other sessions.