Social Recovery

Learn about Mixin Messenger's unique social recovery mechanism to protect your asset security through trusted friends.

What is Social Recovery

Social recovery is Mixin's innovative account recovery solution that allows you to regain account access even if you lose your mnemonic phrase.

Core Concept

Basic Principle:

• Split recovery key into multiple fragments
• Distribute to trusted friends (recovery contacts)
• Need majority agreement to recover
• Distributed security protection mechanism

Comparison with Traditional Methods:

Recovery Method	Advantages	Disadvantages
Mnemonic Phrase	Complete control, instant recovery	Cannot recover if lost
Social Recovery	Can recover even if mnemonic lost	Requires others' assistance
Custodial Service	Convenient and fast	Centralization risk

Technical Features

Shamir's Secret Sharing:

• Cryptographic algorithm ensures security
• Threshold signature mechanism
• Single fragment cannot recover
• Requires K/N fragments (e.g., 3/5)

Security Guarantee:

• Decentralized storage
• Encrypted fragment protection
• Prevent single point attacks
• Time delay protection

Set Up Social Recovery

Preliminary Preparation

Consider Before Choosing Recovery Contacts:

1. Trust Level

   • Long-term acquainted friends
   • Reliable family members
   • Trustworthy colleagues
   • Unlikely to collude

2. Activity Level

   • Frequently use Mixin
   • Easy to contact
   • Respond promptly
   • Stay online

3. Distribution

   • Different geographic locations
   • Different social circles
   • Reduce concentration risk
   • Improve availability

4. Stability

   • Maintain long-term contact
   • Won't suddenly lose touch
   • Responsible people
   • Understand importance

Setup Steps

Complete Process:

1. Enter Settings Interface

   • Open Mixin Messenger
   • Go to "Settings" → "Security"
   • Select "Social Recovery"
   • Click "Set Recovery Contacts"

2. Select Contacts

   • Minimum 3 people
   • Recommended 5-7 people
   • Maximum 10 people
   • Choose from Mixin friends

3. Set Threshold

   • Example: 3/5 (need 3 of 5 to agree)
   • Recommended: N/2+1 (majority)
   • Customizable
   • Balance security and availability

4. Send Invitations

   • System sends invitations to selected people
   • Explain their role
   • Include simple instructions
   • Wait for acceptance

5. Wait for Confirmation

   • Contacts receive notification
   • They need to accept
   • Takes effect after all accept
   • Can check status anytime

6. Distribute Key Shards

   • Auto distribute after acceptance
   • Encrypted storage on their devices
   • They don't need any action
   • Secure and transparent

Invitation Notification

Content Contacts Receive:

[Your Name] invites you to be a recovery contact

As a recovery contact, you will help [Your Name]
recover their account if they lose their mnemonic phrase.

You need to:
✓ Safely store key shard
✓ Confirm identity during recovery requests
✓ Respond promptly to recovery requests

You don't need to:
✗ Remember any information
✗ Proactively do anything
✗ Take any risks

[Accept] [Decline]

Manage Recovery Contacts

View Status:

1. Settings → Security → Social Recovery
2. View recovery contact list
3. Show acceptance status
4. View setup time

Add Contacts:

• Can add new ones anytime
• Increase redundancy
• Improve availability
• Need to redistribute keys

Remove Contacts:

• Can remove any contact
• Takes effect immediately
• Auto redistribute shards
• Others need no action

Replace Contacts:

1. Remove old contact
2. Add new contact
3. Wait for new contact acceptance
4. System auto adjusts

Using Social Recovery

When to Use

Applicable Scenarios:

• Lost mnemonic phrase
• Forgot PIN code and no mnemonic
• Mnemonic damaged and unreadable
• Emergency need to recover access

Not Applicable:

• Only forgot PIN code (using mnemonic faster)
• Changing devices (use mnemonic)
• Regular backup testing
• Mnemonic intact

Recovery Process

Detailed Steps:

1. Initiate Recovery Request

   • Open Mixin Messenger
   • Select "Social Recovery"
   • Enter your Mixin ID
   • Or enter bound phone/email
   • Confirm initiation

2. System Verification

   • Verify account exists
   • Check if social recovery set up
   • Confirm recovery contact list
   • Send recovery request notification

3. Notify Recovery Contacts

   • All recovery contacts receive notification
   • Show recovery request details
   • Inform needed number
   • Start waiting period

4. Contact Recovery Contacts

   • Important: Contact them through other means
   • Call, text, meet in person
   • Inform of your recovery request
   • Request their authorization
   • Prove you are the real person

5. Recovery Contacts Confirm

   • They open Mixin
   • View recovery request
   • Confirm you are real person
   • Click "Agree to Recover"
   • Enter their PIN to confirm

6. Collect Authorizations

   • System collects confirmations
   • Show progress (e.g., 2/3)
   • Can recover after reaching threshold
   • Usually takes hours to days

7. Wait for Security Period

   • After collecting enough authorizations
   • Enter 24-hour security period
   • Original account holder can refuse
   • Prevent malicious recovery

8. Recover Account

   • Security period ends
   • System rebuilds access rights
   • Set new PIN code
   • Generate new mnemonic phrase
   • Account recovery complete

Timeline

Typical Recovery Duration:

Hour 0: Initiate recovery request
  ↓
Hours 1-6: Contact recovery contacts
  ↓
Hours 6-24: Collect authorization confirmations
  ↓
Hours 24-48: Security waiting period
  ↓
Hour 48: Recovery complete

Influencing Factors:

• Recovery contacts' response speed
• Time zone differences
• Contact activity level
• Security waiting period

As Recovery Contact

Role Description

Your Role:

1. Key Custody

   • Auto store key shard
   • Encrypted storage on device
   • No manual action needed
   • Cannot view or export

2. Identity Verification

   • When recovery request received
   • Confirm through other means
   • Ensure it's real person requesting
   • Prevent fraud

3. Prompt Response

   • Process requests ASAP
   • They may be urgent
   • Delays affect recovery
   • Keep Mixin active

Receiving Recovery Request

Notification Content:

Recovery Request Notification

[Friend's Name] requests account recovery

Request Time: 2025-10-05 14:30
Confirmed: 1/3
Need Confirmation: 3

⚠️ Important Reminder:
Please confirm this is a real request from them
via phone, text, or in-person meeting!

[Agree to Recover] [Decline] [Handle Later]

How to Confirm

Verification Steps:

1. Receive Notification

   • View recovery request details
   • Note request time
   • Check request source

2. Contact Them

   • Call to confirm
   • Text to inquire
   • Video call
   • Meet in person

3. Confirmation Questions

   • "Are you recovering your account?"
   • "Did you lose your mnemonic phrase?"
   • Ask questions only they know
   • Ensure not fraud

4. Make Decision

   • Confirmed real person → Agree
   • Have doubts → Decline or later
   • Cannot contact → Handle later
   • Clear fraud → Decline and inform

5. Authorization Operation

   • Click "Agree to Recover"
   • Enter your PIN code
   • Confirm authorization
   • Wait for others' responses

Decline Request

When to Decline:

• Cannot contact them
• They deny initiating recovery
• Suspect fraudulent behavior
• They no longer need it

Decline Effect:

• That contact's authorization invalid
• Doesn't affect others
• They can request again
• Record decline operation

Considerations

Security Reminders:

✅ Should Do:

• Must confirm through other means
• Ask questions only they know
• Decline if doubtful
• Keep Mixin updated
• Inform others of changes

❌ Should Not Do:

• Don't only confirm in Mixin
• Don't easily agree
• Don't authorize when uncertain
• Don't leak key information
• Don't uninstall Mixin

Advanced Features

Emergency Contacts

Set Emergency Contacts:

1. Select 1-2 special contacts
2. They can recover independently (1/1)
3. Suitable for spouse, parents
4. Requires high trust

Use Cases:

• You have emergency
• Family needs asset access
• Quick recovery channel
• Balance risk and convenience

Multiple Recovery Schemes

Layered Setup:

Scheme A: Daily Recovery (3/5)
├─ Friend 1
├─ Friend 2
├─ Friend 3
├─ Friend 4
└─ Friend 5

Scheme B: Emergency Recovery (1/2)
├─ Spouse (Emergency Contact)
└─ Parents (Emergency Contact)

Scheme C: Ultimate Backup
└─ Lawyer/Will (Legal Means)

Recovery Testing

Regular Testing Recommended:

1. Simulate Recovery

   • Don't actually recover
   • Contact recovery contacts
   • Confirm they're willing to help
   • Verify contact methods valid

2. Check List

   • Check quarterly
   • Confirm contacts still active
   • Update those out of touch
   • Add new backups

3. Communication Confirmation

   • Inform of their role
   • Explain how to verify
   • Provide contact methods
   • Express gratitude

Security Mechanisms

Anti-Attack Measures

Multiple Protections:

1. Time Delay

   • Wait 24 hours after collecting authorizations
   • Original account holder can refuse
   • Prevent fast attacks
   • Leave reaction time

2. Notification Mechanism

   • Immediate notification of recovery request
   • Notify each authorization
   • Remind of critical operations
   • Multi-channel notification

3. Refuse Permission

   • Original holder can refuse anytime
   • Single refuse invalidates
   • Need to restart
   • Protect real users

4. Audit Logs

   • Record all recovery operations
   • Show authorization times
   • Track operation sources
   • Transparent and queryable

Threshold Selection

Balance Security & Availability:

Setting	Security	Availability	Use Case
2/3	Medium	High	Regular users
3/5	High	Medium	Recommended
4/7	Very High	Medium	Large amounts
5/9	Highest	Low	Extremely cautious

Selection Suggestions:

• More contacts more secure
• Threshold above majority
• Consider contact availability
• At least 3/5 starting

Common Attack Scenarios

Scenario 1: Multiple Collusion

• Attack: Multiple recovery contacts collude
• Defense: Choose dispersed, unacquainted people
• Suggestion: Different social circles

Scenario 2: Social Engineering

• Attack: Deceive recovery contacts to agree
• Defense: Require multi-way verification
• Suggestion: Establish verification protocol

Scenario 3: Device Hijacking

• Attack: Control recovery contacts' devices
• Defense: 24-hour waiting period
• Suggestion: Multiple contacts dispersed

Scenario 4: Insider Attack

• Attack: Single contact malicious
• Defense: Need majority agreement
• Suggestion: Set threshold high

Best Practices

Choose Contacts

Recommended Combinations:

5 Person Scheme (3/5):
- Close Friend 1 (Same city)
- Close Friend 2 (Different city)
- Family (Parents/Spouse)
- Colleague/Partner
- Other trusted person

7 Person Scheme (4/7):
- Above 5 people
- Another family member
- Long-term online friend/community member

Dispersion Principle:

• Different cities/countries
• Different social circles
• Different age groups
• Independent judgment ability

Inform & Communicate

First Setup:

1. Advance Notice

   • Ask if willing
   • Explain role and duties
   • Explain importance
   • Get consent

2. Provide Information

   • How to verify identity
   • Your other contact methods
   • Information only you know
   • Emergency contact channels

3. Establish Protocol

   • Verification question list
   • Confirmation process
   • Contact method backup
   • Regular confirmation

Regular Maintenance:

• Quarterly confirmation
• Update contact methods promptly when changed
• Thank for their support
• Maintain good relationships

Emergency Plan

Backup of Backup:

1. Primary Method: Mnemonic phrase
2. Backup Method: Social recovery (3/5)
3. Emergency Method: Emergency contacts (1/2)
4. Ultimate Backup: Legal means (will/lawyer)

Document Record:

• Recovery contact list
• Contact methods
• Threshold settings
• Setup time
• Store this info securely

Common Questions

How long does recovery take?

Depends on:

• Recovery contacts response speed: Hours to days
• Security waiting period: 24 hours
• Total: Usually 2-3 days
• Fastest: 24 hours
• Longest: May take 1 week

Can contacts see my info?

No:

• Only store encrypted key shard
• They cannot view
• Cannot export
• Auto managed

How many contacts can I set?

• Minimum: 3 people
• Recommended: 5-7 people
• Maximum: 10 people
• Threshold customizable

Can contacts decline?

Yes:

• Can decline when invited
• Can decline during recovery
• Can exit anytime
• No reason needed

Will assets change after recovery?

No:

• Assets stored on blockchain
• Recovery just gains access
• Quantity exactly same
• No losses

Can I change recovery contacts?

Yes:

• Add new ones anytime
• Remove old ones anytime
• Auto redistribute
• Seamless switch

What if everyone agrees?

• Still wait 24 hours
• Security protection period
• Prevent fast attacks
• Cannot skip

Can old mnemonic work after recovery?

No:

• Generate new mnemonic after recovery
• Old mnemonic invalid
• Need to backup again
• Update all backups

Technical Details

Shamir's Secret Sharing

Algorithm Principle:

Original Key K
  ↓
Split into N fragments (e.g., 5)
  ↓
Any K fragments can rebuild (e.g., 3)
  ↓
Less than K fragments cannot recover
  ↓
Mathematically guaranteed security

Features:

• Threshold signature scheme
• Polynomial interpolation
• Information-theoretic security
• Perfect secret sharing

Encryption Protection

Shard Encryption:

Key Shard
  ↓
Encrypt using contact's public key
  ↓
Only contact can decrypt
  ↓
Store on contact's device
  ↓
Auto manage lifecycle

Recovery Process

Technical Flow:

1. User initiates recovery
   ↓
2. Verify identity info
   ↓
3. Notify recovery contacts
   ↓
4. Contacts confirm (PIN signature)
   ↓
5. Collect K signatures
   ↓
6. Rebuild recovery key
   ↓
7. Security waiting period (24h)
   ↓
8. Generate new key pair
   ↓
9. Migrate account control
   ↓
10. Recovery complete

Compare Other Solutions

Feature	Mixin Social Recovery	Mnemonic	Centralized Custody	Multi-Signature
Recoverable if Lost	✅	❌	✅	Partial
Decentralized	✅	✅	❌	✅
User Friendly	✅	🔸	✅	❌
Security	High	Highest	Medium	High
Depend on Others	✅	❌	✅	✅
Instant Recovery	❌	✅	✅	🔸

Related Resources

• Wallet Recovery - Learn mnemonic recovery
• Two-Factor Authentication - Account security settings
• Create Account - Account creation guide
• Privacy Protection - Comprehensive security guide
• MPC Wallet - Understand MPC technology