Recovery

Nobody at the server can reset an unlock password: it never reaches the server. What a company can do instead is keep every member's keys for an owner to hand back.

Status. Release 0.0.1, the first.

The recovery key

An owner who holds the company owner key makes the company's recovery key once. It is wrapped only to owners and vouched for in the chain by the owner key alone. From then on, every member's browser escrows their private keys to it at their next unlock.

An owner added after the recovery key was made holds no wrap of it and cannot hand keys over; the recovery page says so.

Asking and handing over

1. A member who forgot the unlock password asks from the unlock card. Their browser makes a one-time key pair and sends only its public half.
2. The member reads a short code to an owner, out of band, so the owner knows the request is theirs.
3. The owner's browser opens the member's escrow with the recovery key and wraps the member's keys to the one-time key.
4. The member redeems the request once, within 72 hours, and sets a new unlock password; their browser wraps their keys under it.

Who is refused

An admin, another company, the platform admin and the store's administrator are refused, and the store's administrator finds the escrow sealed. Every read of a member's escrow and every recovery of them is shown to that member after they unlock.

What this means

Owners can restore any member's access, so owners can read every record shared with members of their company. That is the price of recovery, and every member is shown it. It is the fourth item on What it does not protect against.