Trusted contacts

Your trusted contacts receive your sessions, when you share them or automatically in the event of an alert, duress or a missed check-in. Each of them also holds a key share: with the default setting, a single one of them can rebuild it if you have lost your passphrase.

Each contact has their own ripoux.fr account, anonymous like yours.

#Roles

No role allows deletion before the lock ends, or shortening the lock.

A collective (legal team, observatory) can be added too, with read and modify: one of its members opens the invitation link from inside the collective, and all its members then see the shared sessions, the alerts, and who has taken charge of them.

#Key shares and contacts needed

Your master key is split into as many key shares as you have contacts, using secret sharing (Shamir). The Contacts needed setting is the number of key shares that must be brought together to rebuild it.

By default, a single contact is enough: each contact, alone, can rebuild your key. It is the simplest setting, and the safest against loss: a single reachable contact is enough. The trade-off is plain: a contact who rebuilds your key gets your entire key, hence access to your whole account, and needs nobody else to do it. Only give a key share to people you would trust with your passphrase.

To protect yourself against a single contact, raise this number under Advanced settings on the Contacts page, or from My account: with 2 of 3, for instance, two contacts have to come together, and a key share on its own reveals nothing. The screen then shows "2 of 3 contacts can rebuild your key". A higher number protects better against limited collusion, but requires more people to be reachable on the day you need them.

A contact's key share is encrypted for them alone; the server passes it on without being able to read it. Each time a contact is added or removed, and each time the number of contacts needed changes, the key shares are recalculated and redistributed, and the old ones become unusable.

#Adding a contact

1. On Contacts, in the Add a contact section: enter a name (for you only, encrypted), a role, and a link protection phrase.
2. Create the invitation link produces a single-use link, valid for 48 h.
3. Send the link through one channel, and give the phrase verbally, never through the same channel as the link.
4. The contact opens the link, signs in or creates their account, and enters the phrase. They receive their key share, which they immediately encrypt for themselves.
5. They appear in your list, with the status of their key share: "Held, verified on …".

Until the invitation is accepted, the contact is marked "invitation sent", with no key share. Cancel invitation makes it unusable.

The phrase protects the key share in transit. Someone who intercepted the link without the phrase could do nothing with it, unless they guessed the phrase: choose a long one.

#Removing or editing a contact

Edit changes their name or role. Removing a contact redistributes the key shares to the others: their key share becomes useless. Sessions already shared with them remain shared: an opened access cannot be withdrawn, so that nobody can force you to cut a share. Standby access, prepared but not yet opened, is removed.

#Recovering your account

If you have lost your passphrase and your recovery key:

1. Go to the recovery page and enter your identifier.
2. A request goes out to your contacts. Let them know by another means, so they know it really is you.
3. Each contact who accepts decrypts their key share and re-encrypts it for your request, and only for that request.
4. As soon as enough contacts have accepted, your browser rebuilds the key. You choose a new passphrase.
5. The key shares are then regenerated and redistributed.

A contact who receives an unexpected recovery request must check with you verbally that it really comes from you before accepting. A request started by someone else with your identifier only succeeds if your contacts accept it.

If you have your recovery key, your contacts are not needed: see Getting started.

#What a contact sees

A contact sees the sessions shared with them, read-only. For each one: the person, the duration on the server, the seconds not received, the reason for sharing ("Under duress", "Immediate sharing", "Shared by the person"), and the date the lock ends.

In the event of a duress code or a field alert, a red alert appears at the top of their page, with the time of the last images received. I'm handling this tells the other members of a collective that someone is dealing with it.

A session hidden from your contacts disappears from every contact's view.