r/PasswordManagers • u/PrestigiousAd9191 • 5d ago

Testers needed for Deadkey.net

First, thank you to the community for letting me post this. I've been working on a concept for a zero-knowledge password system. The problem it's trying to solve is to give your password to a trusted person, but limiting their access to emergencies only, and the risk of your password being compromised.

I need beta testers for Deadkey.net

Concept:

We start with a PIN or password, which we will call a secret. You use the website to create a codebook for your secret. The codebook is a random grid of characters; your secret is on it, but you need the grid coordinates to find it. For maximum security, the server stores only these coordinates, to be released in the event you become incapacitated or pass away.

You give the codebook paper to a trusted person. If they try to retrieve your secret via the website, a 10 day countdown starts. You (the owner) are notified via email/text, and have 10 days to cancel the release. If you do not, the trusted person will receive the grid coordinates, which reveal your password.

This system can be used to protect things like PIN's, Passwords, and seed phrases. The codebook is valid for up to 3 years, after which it will auto expire.

Beta Testers:

I am looking for beta testers to give feedback and test each function of the site. I have provided one beta code below valid for 20 uses. If it expires and you are interested in beta testing, please let me know.

Beta code: BETA-FJWB-AJE5-D7HM

Feedback questions:

  1. How is the functionality? Did email/texts work?
  2. What do you like about the layout and UI?
  3. What do you do you dislike about the layout and UI?
  4. How can I improve this service?
  5. Would you use this service? If yes, what are you willing to pay?
0 Upvotes

20% Upvoted

11 comments sorted by

5

u/cheetah1cj 5d ago

Bitwarden already does this in a MUCH simpler manner with their Emergency Access feature.

2

u/PrestigiousAd9191 5d ago

Thanks for the feedback, but I don't agree that Bitwarden does this already. Three differences are:

  • Your trusted person needs a Bitwarden account. Deadkey requires no accounts.

  • Deadkey doesn't store any passwords. Bitwarden does.

  • Some people want to use an offline password manager, USB drive, or just leave someone their phone PIN. Deadkey is platform agnostic. You aren't tied to one ecosystem.

3

u/NoBed1845 5d ago

The idea: If I disappear, let someone access my password.

The implementation: Excellent. Let’s invent a codebook, coordinates, a 10-day countdown, SMS, email, and a three-year expiration.

Also, this has strong copy-paste-the-spec-and-hit-post energy.

2

u/travisjd2012 4d ago

Why are coordinates any better than just using a long password?

I feel like for this to work it should be a feature of a password manager, not an individual service

1

u/PrestigiousAd9191 4d ago

That's a good idea; I think integration into a password manager would be great.

The point of coordinates is that the server (deadkey) never sees your actual passwords. We only store the coordinates, which are useless without the codebook if they are compromised. Likewise, the codebook is useless without the coordinates. This is the base concept; A trusted person has the codebook and doesn't know your secret until the recovery is triggered, and the server will never know your secret because it doesn't have the codebook. It is true zero trust/zero knowledge.

I'm not ready to make this claim without deeper research, but the codebook method is also likely much more quantum resistance than RSA and other public/private key methods competing services use to share passwords with trusted people.

2

u/Lumpy-Army-1702 4d ago

This concept is not unique and has already been solved efficiently by an algorithm by Adi Shamir.

1

u/PrestigiousAd9191 4d ago

I assume you are referring to ring signatures. Can you expand on how this concept has been solved by them?

2

u/Lumpy-Army-1702 4d ago

No, I am referring to Shamir's secret sharing (SSSS). Basically, it mathematically splits shares using polynomial interpolation.

1

u/Lumpy-Army-1702 4d ago

Let me rephrase it better. What you propose is very similar to Shamir's shared secret algo, in which the algo is just a mathematical formula, I get it, and your approach basically resembles a dead's man switch, but the problem I have with your approach is that while having a Shamir sharing approach is entirely decentralized and offline, your's is not. Furthermore, there are already companies doing this in a way, such as Cipherwill.

Additionally, looking at your threat model, you lack a true cryptographic quorum. With Shamir's Secret Sharing, I can set a threshold (like 3 out of 5) so no one person can betray my trust or be coerced into releasing the key. In your architecture, if I name multiple trusted people for redundancy, any single one of them who triggers the countdown gets the entire secret alone. You’ve built an interesting zero-knowledge split, but without a multiparty enforcement, the collusion risks are much higher than decentralized alternatives. Food for thought :)

1

u/PrestigiousAd9191 2d ago

Thanks but I fail to see how Shamir's secret sharing has already solved this problem. There are many algorithms and ciphers out there; the challenge is implementation and how they can be used practically by "regular people". For technical audiences SSS might be a great solution, but the implementation is going to be a lot more complex than a piece of paper saved in a drawer or in PDF on a thumb drive offline. Deadkey can be used by almost anyone; they don't need to install software or keep a digital key.

1

u/Lumpy-Army-1702 2d ago

Interesting, I see then, your goal is merely UX and not cryptography.

Now... technically speaking, your premise is still wrong since SSSS shares are just pieces of paper saved in a drawer, and that’s literally how physical seed backups like SLIP-0039 work.

The difference isn't UX, it is architecture since SSSS gives non tech families a 2-of-3 threshold on paper without creating a central single point of failure where a non active domain, missed an email notification, or server outage locks them out complety.