karpatka122
Joined 2 months ago
Karma
1
Submissions
4
Member since
Aug 11
Recent submissions
Comment · 16 hours ago
The system is designed with redundancy - it's enough to gather the minimum required number of shares (e.g. 3 of 5). One or two people being unavailable doesn't block the emergency procedure.
Comment · 17 hours ago
I am familiar with these solutions, but they only create a secret—nothing more. That is why Secret Key fills "this gap."
Comment · 18 hours ago
Secret Key is a self-hosted emergency access system for password databases. It splits the master password into shares distributed among trusted people.
The idea came to me during a trip in the mountains. I started wondering what would happen to all my online accounts if I didn't come back.
It uses Shamir Secret Sharing via secrets.js, compatible with iancoleman.io/shamir. Trusted people authenticate via SMS, and once enough shares are provided, the master password is reconstructed in the browser. A 48-hour download lock gives the owner time to react using a Panic Button that blocks the download.
Some limitations: the project has not undergone an independent security audit, SMS relies on an external provider, and the 48-hour lock delays downloading the vault but cannot prevent someone with enough shares from mathematically reconstructing the secret. The demo UI is currently only in Polish.
I'd appreciate feedback on the threat model: what attack scenarios or security assumptions am I overlooking, particularly regarding collusion between trusted participants?
Project: https://secretkey.website Demo: https://app.secretkey.website Documentation: https://secretkey.website/docs/ GitHub: https://github.com/mateuszkarpierz/secret-key