Signing in
The identifier-first sign-in flow, the methods it accepts, and the limits that throttle a wrong password.
Every Gigadrive product sends you to the same sign-in screen at account.gigadrive.de/gdsa-box/auth. Open the console while signed out and you land there with a returnTo pointing back at the page you wanted.
The flow
Sign-in is identifier-first. You give an email address or username, Gigadrive works out which methods your account has, and only then asks for a secret.
- Identifier. Type the email address or username. A bot check runs before the lookup.
- First factor. Password today. The screen also offers a passkey and the linked providers, both of which skip the identifier step entirely.
- Second factor, if you have one enrolled. See Two-step verification.
- Done. You are returned to whatever sent you, or to the account overview.
A sign-in in progress carries a status: NEEDS_FIRST_FACTOR, then NEEDS_SECOND_FACTOR or NEEDS_NEW_PASSWORD, then COMPLETE. An abandoned attempt goes to ABANDONED and cannot be resumed, so the message is "Your sign-in session expired. Start again."
The methods a first factor can be
| Method | Starts from | Notes |
|---|---|---|
| Password | The identifier screen | Minimum 8 characters. There is no character-class rule. |
| Passkey | "Sign in with a passkey", no identifier needed | See Passkeys |
| Google, Microsoft, Facebook, Apple ID, GitHub | The provider buttons | See Connected accounts |
| Sign-in link or emailed code | The password screen, only when email verification is enabled on the account | Replaces the password for that attempt |
A code from an authenticator app is never a first factor. It only ever confirms one.
Throttling
Two counters guard password sign-in, both on a fixed 15-minute window.
- 10 attempts per account. A correct password clears it, so someone who eventually remembers their password carries nothing forward.
- 50 attempts per source IP. Never cleared on success, because one address legitimately fronts an office or a carrier NAT.
Both counters are consumed before the account is looked up. A throttled attempt therefore tells an attacker nothing about whether the address is registered, and the message is the same either way: "Too many attempts. Try again in a minute."
Registration
New accounts are created at account.gigadrive.de/gdsa-box/register in two stages: first name, last name, email address, and a password, then a six-digit code emailed to that address. Nothing exists as an account until the code is confirmed. What you typed is held server side for 24 hours, the code itself expires after 10 minutes, and five wrong guesses burn it.
Signup is rate limited per hour: 20 registration starts per IP, 5 per email address, 10 verification-code resends per IP, and 5 per email address.
Password recovery is not available yet
/gdsa-box/reset-password currently only tells you so. If you cannot sign in and have no other method on the account,
write to cs@gigadrive.de. Adding a passkey or a linked provider is the way to avoid needing it.