Each web2 account trains customers to count on a password reset e mail as the security internet. Thanos Pockets has no such movement, as a result of the one entity that might ship that e mail can be a 3rd celebration holding a replica of the person’s keys — which is precisely what self-custody is constructed to keep away from.
Most individuals’s instincts round account entry had been fashioned by a long time of web2 software program. Overlook a password, click on a hyperlink, obtain an e mail, set a brand new one, and the account is accessible once more. This sample is so constant throughout e mail suppliers, banking apps, and social platforms that it has turn into an assumed baseline for what account restoration is meant to appear like. A brand new Thanos Pockets person, encountering a pockets for the primary time, might moderately count on one thing just like exist — and could also be shocked, even involved, to find that it doesn’t.
The explanation it doesn’t exist is structural, not an oversight. A ‘forgot password’ e mail movement solely works as a result of the service on the opposite finish holds one thing that lets it confirm id and restore entry — sometimes a replica of the account knowledge, or at minimal the authority to reset the credential gating entry to it. For that movement to exist in a pockets, the pockets supplier would want to carry a replica of the person’s keys, or maintain the authority to reset entry to them. Both of these situations describes a custodial relationship. It’s exactly the connection self-custody is constructed to keep away from.
Thanos Pockets doesn’t maintain a replica of the person’s keys. The mnemonic and the keys derived from it are generated and saved regionally, on the person’s gadget, contained in the AES-encrypted vault. There isn’t any server-side document Thanos Pockets may seek the advice of to confirm who’s asking for entry, and no account database it may use to concern a reset. This isn’t a lacking function relative to what a web2 service would provide. It’s the direct consequence of the pockets not custodying something on the person’s behalf within the first place — there’s nothing on Thanos Pockets’s facet to reset, as a result of there was by no means something on Thanos Pockets’s facet to lose.
The precise restoration mechanism in Thanos Pockets is the 12-word BIP39 restoration phrase established when the pockets is first arrange. This phrase is the account, in each sense that issues for entry. It’s generated on the person’s gadget, it by no means leaves that gadget throughout regular use, and it’s the solely credential able to restoring entry if a tool is misplaced, an app is reset, or a password is forgotten. There isn’t any secondary channel, no backup authority, and no override — which is uncomfortable to a person accustomed to web2 security nets, however is the trustworthy form of what self-custody really requires.
For this reason the restoration phrase, and never the pockets’s password, is the credential that truly issues. A forgotten password inside Thanos Pockets is a minor inconvenience, resolved with the restoration phrase. A misplaced restoration phrase with no backup isn’t resolvable by anybody — not by Thanos Pockets, not by KaJ Labs, not by any assist channel, as a result of nobody in addition to the person ever held a replica of it to revive from. The absence of a password reset e mail isn’t actually in regards to the password in any respect. It displays a pockets the place the restoration phrase, not a login credential, is the one factor standing between a person and everlasting lack of entry — and that’s precisely how a self-custody pockets is meant to work.
Understanding this distinction adjustments how a brand new person ought to deal with the restoration phrase from day one. It’s not a password {that a} assist staff can reset if forgotten. It’s not a credential recoverable by way of an e mail hyperlink. It’s the total account, current in precisely one place till the person chooses to jot down it down someplace else — and the absence of any fallback for dropping it’s not a niche in Thanos Pockets’s design. It’s what makes the pockets genuinely self-custodial somewhat than custodial with additional steps.
