New phone, same identity
An email account follows you to a new phone. A cryptographic key has to be carried there by hand, usually as twelve words on a card. Sigma Auth closes that gap by splitting recovery into two steps: an account you already have finds the encrypted backup, and a secret that never left your device opens it.
By Sigma Auth9 min read
The twelve words in the Notes app
Anyone who has held a cryptographic key knows the routine. A new laptop arrives, or a phone dies, and somewhere between unboxing and the first coffee you have to find the words. Twelve or twenty-four of them, written on a card in a drawer. More often than anyone admits, they are in a Notes app, a text to yourself, a screenshot, or an email draft. You type them into the new device, and for a few minutes your whole identity sits as plaintext on a screen, in a clipboard, and in whatever sync service the Notes app uses.
Getting a new phone and opening your email goes differently. You type an address and a password, maybe approve a prompt on the old device, and you are in. Nothing was carried. The account lives with the provider, and the provider let you back in.
The seed phrase routine exists because of a rule its designers got right: if someone else can hand you your key, that someone can also hand it to a person who is not you. Web2 sign-in is convenient because the provider holds the account and can give it back. The same property lets the provider lock you out, reset you, or be compelled to hand the account over.
So the seed phrase in the Notes app became the compromise between convenience and ownership.
Recovery is two jobs
“Recovering an account” covers two separate jobs. The first is finding: out of everything a service stores, which record is yours? The second is opening: turning that record into something you can use. A web2 password does both in one motion. It locates the account and unlocks it, which is why a stolen password is a total loss and a provider reset is a total restoration.
An account you already trust finds the backup. You open it.
The thing being found is an encrypted backup of your identity keys. It was encrypted on your device before upload. Sigma stores the ciphertext, which is unreadable without the decryption secret, and Sigma does not have that secret. Beside the ciphertext sits one durable mapping: the stable account ID of the Google or GitHub account you linked points at the BAP identity whose backup it can recover. The cloud backup docs list what is kept.
Applications in the Sigma ecosystem