Hacker News new | ask | show | jobs
by TheMatten 934 days ago
Page linked in the text seems to have a friendly explanation of how it works: https://anastasis.lu/

If I understand this right: you generate two keys using your identity, split your secret (e.g. master password) into separate parts, encrypt each part with the first key and and pair it with a challenge encrypted using the second key, and distribute those pairs to different providers. Then, you can retrieve your secret by once again deriving those keys, sending the second key to each provider and answering respective challenges, so that each provider agrees to send you their secret part, which is decrypted using the first key.

So you don't have to keep the secret around, and providers don't know who you are and what you store there; they only learn about contents of the challenge, once you ask for their part of secret.

Obviously, challenges may reveal personal information about the user, but the system doesn't put any restrictions on what they should be - and it seems like it should be easy to introduce redundancy by sending one piece to multiple providers, possibly with different challenges.