Recovery phrase security
Your recovery phrase unlocks your location history on a new phone. The server never receives it, or the keys it protects.
Who can read your history
- Someone who has taken over your sign-in, but not your phrase, can't read your history. A phone they sign in on can't see anyone's location until it's set up, and we email you about the new sign-in if your server sends email. To set it up without one of your phones, they'd need to reset your phrase, which we also email you about. You can remove their phone.
- Someone with your phrase and access to your account can read your history.
- Someone with your password can reset your phrase, after confirming with a code emailed to you if your server sends email. That deletes your recovery data, but doesn't give them your earlier history. We email you when your phrase is changed or reset.
- Someone who can read your email can reset your password with an emailed code, unless you only sign in with Google.
What the server can see
- whether you have a recovery phrase
- when you set it up, and when you last changed or reset it
- when a phone fetches your recovery data, for example to restore
- how many versions of your history key there are, and when each was created
- how many of each group's keys are protected for you.
Other members' phones can also see whether you have a recovery phrase, because they protect new group keys for you.
Protections
- The phrase setup screen blocks screenshots and screen recording, and has no copy button.
- Setting up, changing or resetting your phrase needs a sign-in from the last 30 minutes.
- When you restore, your phone only accepts recovery data that was made with your phrase, so a server can't substitute its own.