How keys are checked
Encryption only protects a credential if it goes to the right key. SafeHanded’s server hands your browser each recipient’s public key, so your browser checks that key before it seals anything to it. The checks are designed to catch a key slipped in by a server that was tampered with, or written straight into its database.
What your browser checks
Section titled “What your browser checks”Everyone has a signing key as well as their vault key. It lives inside their vault, so only their own browser can use it, and it signs a short statement saying “this vault key is mine”. Before your browser seals a credential to a colleague, it checks:
- the statement names exactly the key it is about to use, and the right person;
- the statement is signed by that person’s signing key;
- that signing key is the one this browser saw for them before.
The server checks the same thing before it seals anything on its own (requests made through the API, from a ticket or by a campaign).
You don’t need to do anything for this. Your browser signs your keys when you open your vault, or as soon as you open SafeHanded in a browser that already has your vault open.
The warnings you might see
Section titled “The warnings you might see”“First time this browser has seen the key of …”. Normal the first time you send to someone. From then on the browser warns if it changes.
“Not signed yet: …”. Their key was made before SafeHanded signed keys, so it was used as it is. It is signed the next time they open their vault, and checked from then on. Nothing to do.
“Their signing key is different from the one this browser saw before”. Nothing was sent. This happens when someone has started over with a new key, or if something is wrong. Ask them to read the signing key fingerprint on their Keys page, in person or on the phone. If it matches the one shown, tick I checked this fingerprint and send again. If it doesn’t, don’t: tell your administrator.
“This is a replacement key an administrator has not approved yet”. The person lost their old key and set up a new one. An Owner or Admin approves it (below); until then you can send after checking the fingerprint with them.
“They set up secure delivery again on …”. A secure delivery recipient set up a new passkey. Phone them and check the fingerprint they see under each secret they open, then choose Use their new key, or send the normal way instead.
“This key has not been signed yet” / “does not check out”. Nothing was sent and this can’t be overridden. If a colleague replaced their key recently, ask them to unlock their vault in SafeHanded so it is signed. If it keeps happening, tell your administrator: it can mean tampering.
Approving a replacement key (Owners and Admins)
Section titled “Approving a replacement key (Owners and Admins)”When a member loses every way into their old vault and starts over, their new signing key needs approval in each organisation they belong to. You’re notified, and the member shows Key needs approval on the Members page. Only an Owner approves an Owner’s key, and only someone who held their role for at least 7 days before the start-over. (Where nobody could approve it, it starts working 72 hours after they started over instead, and nobody can approve it sooner.)
- Ask the member to open their Keys page and read out their signing key fingerprint.
- Click Approve key and check it matches the one shown. Your browser works it out from the key it is about to approve, not from anything the server says.
- Confirm. Your browser signs the approval with your own key.
Approve only after checking: the approval is what lets requests reach them again. Someone who has only the member’s email can start over in their name, so never approve on the strength of an email or chat message: check the fingerprint with the member by phone or in person. After a start-over, the approved key still receives nothing until 72 hours after the member started over, and until then their old key can cancel it. Only people who have been an Owner or Admin for at least 7 days count as approvers, and never someone the member invited or promoted themselves.
Emails you’ll get
Section titled “Emails you’ll get”Whenever a key is set up or replaced on your account, SafeHanded emails you its fingerprint. If you didn’t just do that, tell your administrator straight away.