Website Security
How the website protects accounts and shared resources, what you can do to stay safe and how to report a suspected problem.
Security is shared between the website and the people who use it. This page summarises the protections built into the website, practical habits that keep your account and shared catalogs safe, and what to do if something looks wrong.
Protections built into the website
- Passwords are stored only as scrypt hashes, a deliberately slow one-way method that makes stolen data much harder to reverse.
- Passwords are submitted in forms and never appear in page addresses, browser history or shared links.
- Session cookies are signed, HttpOnly and SameSite=Strict, so scripts cannot read them and other sites cannot use them.
- Requests that change data must come from this website's own pages, which blocks cross-site request forgery.
- A strict Content Security Policy only allows scripts that belong to the website, reducing the risk of injected code.
- Only approved file types are served from public folders, and folder listings are disabled.
- Protected products, models and catalogs are checked on the server before any image or file address is sent to the browser.
Protect your account
- Use a password of at least eight characters that you do not use on any other service. A short passphrase of several unrelated words is easier to remember and harder to guess.
- Consider a password manager so that each website gets a unique password.
- Sign out after using a shared or public computer, and do not let a shared browser remember your password.
- Keep your browser and operating system up to date.
Sharing protected catalogs and products
Some resources are reserved for selected partners. Their passwords are provided separately by Duc Toan. Share the link and the password only with the people who are meant to see the resource, and preferably through different channels, for example the link by email and the password by phone.
Unlocking lasts up to 72 hours on the browser where the password was entered. Viewing permission does not include permission to copy, publish or redistribute images, catalog pages or 3D models. If you think a password has been passed on too widely, tell us so it can be changed.
Temporary access restrictions
To discourage automated copying, the website watches for signals commonly associated with browser developer tools being used on public pages. If such signals continue for some time, the browser is restricted for a short period, currently about 15 minutes, and a page explains the restriction. The restriction ends by itself; no action is needed.
These signals are estimates and can occasionally be triggered on a slow device. If you are restricted while browsing normally, wait for the period shown and contact us if it happens again.
Encrypted connections
When the website is published on its public address, use the address that begins with https and check the padlock in your browser. It means that the data travelling between your device and the website, including passwords typed into forms, is encrypted. Avoid entering passwords if your browser warns that the connection is not secure.
Public Wi-Fi in cafés, hotels and airports is convenient but shared with strangers. If you must sign in on such a network, make sure the secure address is used and sign out afterwards.
Separate areas and separate passwords
The website has three kinds of access, each with its own password and cookie:
- customer accounts, signed in with an email address and password;
- protected products and catalogs, opened with a resource password supplied by Duc Toan;
- the management area, used only by Duc Toan administrators.
Having one kind of access does not grant another. A customer account does not unlock protected catalogs, and an unlock password does not give access to an account. The management sign-in temporarily blocks further attempts after several incorrect passwords in a short period.
If you forget your password
The website does not have an automatic password reset. Contact Duc Toan from the email address you used for your account. We will never ask you to tell us your old password; once your identity is confirmed, the account can be handled manually. For protected products and catalogs, ask the person at Duc Toan who shared the link with you.
Files you save from the website
Swatch downloads and snapshots from the variation editor are images created from the website's own content. Snapshots are generated in your browser and saved to your device; they are not uploaded anywhere. The website never asks you to install software, browser extensions or plug-ins to view products, catalogs or 3D models. Treat any such request as suspicious.
Recognise suspicious messages
Duc Toan will never ask for your account password by email, chat or telephone, and will not send links that ask you to sign in on a different website. Check that the address bar shows this website before entering a password. If a message claiming to be from Duc Toan asks for payment changes or passwords, verify it using the contact details published on this website.
Report a suspected issue
If you notice a security problem, please tell us through the contact page and include:
- the page address and the approximate date and time;
- your browser and device;
- a short description of what you saw and the steps that led to it.
Remove passwords, cookies and unrelated personal data from screenshots. If you accidentally reach information that seems private, stop, do not copy or share it, and report the page. Please do not run automated scans or tests that could disrupt the service.
Related pages
