How your Trove content is protected
This app treats signing in and reading your Trove content as two different problems, which may be protected by two different secrets. Understanding the distinction makes every other security option on this site much easier to understand.
Two secrets, two jobs
- Your login password
- Proves to the server that you are who you say you are. The server checks it before accepting that you are who you claim to be. Password verification happens on the server. So anyone with access to the server code can potentially see your password and hijack your identity.
- Your Trove unlock key
- Decrypts the actual content of your Troves inside your browser. The server never sees this key, and never sees your unencrypted content. By default this key is derived from your login password. If you turn on a Trove Unlock Password, it is derived from that instead. This means that even if someone discovers your login password, they still can't read your Trove content without also knowing your Trove Unlock Password.
- 2-Factor Authentication
- Adds an extra layer of security by requiring a second form of verification (like a code from your phone or an authenticator app) in addition to your password when logging in. With 2FA enabled, even if someone knows your password, they still can't access your account without the second factor. That also means that if you lose access to your second factor, you may need to use a recovery code or passkey to regain access to your account.
- Passkeys
- When you use a Passkey to log in, the server checks a cryptographic signature instead of depending on your password. This reduces the risk of phishing and makes it impossible for the server to see your password during login. A Passkey can be used both to log in and, if it is PRF-capable, to unlock your Trove content on a device where you registered it without needing to enter either password. (You may have to enter your Trove Unlock Password the first time you use the Passkey after changing your TUP.) What's more, we consider a Passkey to be a second "Factor", so when you use Passkey login, you don't need to enter a second factor to access your account, either. This provides the most convenient and secure way to access your content while still keeping it protected.
What the server can and cannot see
- The server can see: your email, the shape of your Troves (how many, when modified), and every byte of your content in encrypted form.
- It can also briefly see your login password every time you use your password to login.
- The server cannot see: your Trove Unlock Password, your private encryption keys, or any of your Trove content in plain form.
Why this matters for recovery if you forget the password that protects your Trove access
Because the server can't read your unlock key, it can't reset your Trove access the way it can reset a forgotten login password. That's what recovery codes are for: an offline safety net that you hold. A PRF-capable passkey is a second safety net: it can unlock your Trove content on a device where you registered it. But not all Passkeys are PRF-capable, so even if you use a Passkey, you should also be sure to save recovery codes as a safeguard against the possibility that your Passkey may not be able to unlock your Trove content on its own.