[usermaneGermane]

SecretSpace 3, phase 5, client side: a forgotten master password is no longer the end. A test version (pre-release); it needs SecretSpace Server 2.0.0-alpha.4 for an account on a server.

Recovery

• "Forgot your master password?" on the login screen. The steps: the account name and the 12 words, then a new master password, then a new Emergency Kit if one is needed, then the new phrase written down and checked. Nothing is written before the last step.
• Same keys. The same keyset opens again under the new password, so every vault, share and signature still works. The old phrase stops working.
• The Secret Key. It is kept when this PC can read it without the master password (Windows DPAPI). Otherwise a new one is made and a new Emergency Kit shown: on a new PC, and on Linux, where the stored key is sealed under the forgotten password.
• On a new PC the account comes from its server (address asked in step 1), with all its vaults.
• Server first. An account on a server is changed there first; the PC then signs in like any device. If the server cannot be reached, nothing changes. Other devices sign in again with the new password.
• New phrase. Settings → Recovery phrase → New phrase… replaces a phrase that was lost or seen. Other devices take the new copy at their next sync.
• Older accounts send what the server needs for recovery once, at their next sync. New accounts send it at sign-up.

Code

• recovery.py (no widgets): open with the phrase, prepare, save; NewPhrase.
• recovery_ui.py: the screens. The kit and phrase windows of dialogs.py are reused.
• account_crypto.seal_recovery, account_crypto.recovery_proof, accounts.replace_keys, Account.set_recovery.

Tests

• New test_account_recovery.py: 27 tests, on a PC alone and through the test copy of the server.
• 12 deliberately broken guards, all caught (two needed a test added first).
• Full suite green locally.
• Lab flow through the real windows (flows_recovery.py, three devices): 83/83, twice.

tests/sync_server/passman_server.py is server 2.0.0-alpha.4 (Server PRs #13), byte for byte.

🤖 Generated with Claude Code

https://claude.ai/code/session_011ojnyVg7ccsR3pZ64s7aRH