What prevents a 3letter agency from instructing you to:

1- give access to one of you trusted contact accounts

2- disable sending notifications to the account holders email

3- 3letter agency clicks on request data

4- data gets released ( as it will not get denied if the account holder does not receive a notification)

Thanks for this!

1 - Even with access to the trusted contact's account a passphrase/access key (specific to the main account and not stored by the service) is required

2 - Interesting scenario but still requires the above-mentioned access key

3 - Same as above two points even after being approved

4 - Won't get released without the key

> 1 - Even with access to the trusted contact's account a passphrase/access key (specific to the main account and not stored by the service) is required

I understand that your service is encrypting the data before saving it (vs that happening completely on the client and only encrypted data being sent to you), so there's nothing stopping you from logging it to a plain text file (even accidentally). Given that these passwords will likely hold the keys to that person's identity, that's a huge amount of trust that they need to have in you, your technical abilities and future decisions.

100% agreed with you here - no denying it - and no different from any service that we use where it's up to our trust that they will do the right thing. That said, I can for sure revisit my encryption strategy.

Overall that's one uphill challenge I've seen emerge as I've chatted with folks about the product: inspiring trust.

sounds reasonable, a couple more questions:

do i provide the trusted contact the access key or how does that work?

When is it generated?

What if add a new trusted contact or remove one how does that change things?

Bring on the questions! I don’t mind one bit. Feel free to tweet or email me if needed too (email at the bottom of the landing page)!

What’s funny is earlier versions of the landing page had way more detail for what you’re asking about and I got chided for it during user testing reviews haha.

Every user generates their own key (which can make it more friendly) and would need to provide it to their contacts on their own. It’s required to be set before you add any data.

Modifying users doesn’t change anything for me. Any new contact would need to be sent the same key or you can change it! Old users wouldn’t be able to request access regardless of knowing your (maybe old) key.