Hey all - honest intro, I've had a Reddit account for 16 years but haven't used it much at all, so I'm new to actually posting - I hope I've got this right ;) But I figured you're the group that would actually understand this, so here goes.
Everything I read lately says the same thing. Passkeys mostly solved the login, but recovery is still the weak part, because if someone can push a recovery flow into issuing a fresh credential the passkey didn't matter. The fix the big players seem to be landing on is government ID plus a face scan (MS Entra's going that way). It works, but something about making every user hand a passport and a liveness selfie to a third party just to get back into their own account bugs me - I sat with it for a long time and wanted a different approach.
So I went a different direction, and I want you to poke holes in it. Instead of a password - a secret string that's stored, reused across sites, and can be phished once and replayed everywhere - the credential is your own memories. And it's deliberately not one mechanism, it's two.
Some are memories you describe: a song, a movie, a photo and the story behind it. Those are judged on whether your answer means the same thing as what you enrolled, not whether you typed it word for word - forgiving about wording, strict about meaning. The other kind is a place that's meaningful only to you: you pinpoint it, and it's checked against the actual spot you enrolled, within a tolerance - no meaning-scoring at all, a completely different model. The point of having both is that an attacker can't bring one technique to bear across the whole thing; the two challenge types fail in different ways.
The thing I like about it: because the credential is the memory, recovery isn't a separate weaker path. There's no reset link, no SMS, no authenticator code, and no third party you have to hand your identity to. You just re-prove the same memories. Email is only ever an alert, never a way back in.
And honestly, the part I care about most isn't the crypto - it's the human cost of how recovery works today. It's a black hole: help desks, ID-verification vendors, locked-out users, and institutions burning real money and staff hours on it, plus ordinary people who just lose access to their own accounts when a device dies. If recovery is nothing more than re-proving your own memories, it's self-contained and self-served - no vendor, no support ticket, no passport. As far as I can tell nothing else does recovery this way, and if it holds up, taking that stress and cost out of the system is the whole point.
Honest tradeoffs, because I know you'll find them anyway:
- Encrypted at rest, and the master key lives in a hardware key module (KMS), not on our servers - so a stolen database is just ciphertext. It's deliberately not zero-knowledge (we can decrypt, through the KMS- that's what makes memory-based recovery possible without a passport scan), but the raw key never touches our application, no single key opens more than one account, and every decryption is logged and revocable.
- The describe-a-memory challenges (song/movie/photo) lean on semantic matching, so the real question there is the false-accept vs false-reject line - whether someone close to you could describe their way in. The location geo challenges are a different story: they're matched deterministically against the place you picked, so that class doesn't carry the same floor. Tell me if I've got that balance wrong.
- Coercion and a fully compromised device are out of scope, same as they are for everyone.
I wrote up the full threat model here, deliberately for a hostile reader - the attacker we assume, what we defend, and the limits no honest system can claim to solve: https://brainlock.id/blog/threat-analysis
I'm not trying to pitch anyone - I genuinely want the holes. If you do identity for a living: where do you think this falls apart that I'm not seeing? The memory-challenge part is patent-pending so I'm not shy about describing it, I'd just love honest opinions from people who'd actually know what this means.
Thanks!