Recovery and start over

Only an admin’s Mac can approve people and change the team’s keys. If every admin’s Mac is lost, the team needs its Team Recovery Kit. This page covers how to avoid that, how to use the kit, and what’s possible without it.

Avoid it: a second admin

The console’s setup checklist asks for a second admin, and any team with one admin shows a standing warning in the console and in the app. Two admins on different Macs make recovery almost never necessary.

Recover with the Team Recovery Kit

Use the kit when no admin’s Mac is left. The owner, or anyone the owner gives the kit to, can do it. That person must be a member of the team or have an invitation: the owner can invite them from the console’s Members page.

1. On a Mac with Cloak Proxy 0.7.4 or later, sign in to Cloud with your invited or member address in Settings › Cloud, then open Settings › Team.

2. Under the team, click No Admin’s Mac Left? Recover with the Recovery Kit… and enter or scan the kit.

3. Before it signs anything, your Mac checks the team’s history against the other members’ signed checkpoints. With fewer than two other members’ Macs to check against, only the code comparison stands, and the app says so: compare the Team Security code with a teammate before you go on.

4. Your Mac becomes an admin’s Mac. It makes a new team key and opens every restricted space, because each one’s key is also sealed to the kit. In Settings › Team, check the team’s Macs and remove any you don’t recognize.

5. Compare the Team Security code with a teammate, when your Mac asks.

Recovery doesn’t sign anyone else out: the other members’ Macs belong to other people and keep working. Admins’ Macs show “The Team Recovery Kit was used. Was this you or someone you trust?”, and the audit log records it. Make a new kit afterwards if the old one may have been seen by someone else.

Why steps 4 and 5 matter

A Mac recovering with the kit has nothing of its own to compare the team’s history with, so it relies on the history the server sends. A compromised server working with a Mac that was removed earlier could show it a history in which that Mac is still a member, and recovery would then give that Mac the new team key. The other members’ checkpoints, the list of Macs and the Security code comparison are how you catch that.

No admin’s Mac and no kit: start over

If every admin’s Mac and the kit are lost, nobody can change the team’s members again, including Subcloak: we don’t have the keys. Members’ Macs keep working with what they have, but no new person or Mac can join, no one can be promoted, and removing someone in the console cuts off their access without changing the keys.

Starting over isn’t in the console yet. The owner writes to team-support@subcloak.com from the owner’s address. Before we change anything, we check it’s the owner: a code we send to the owner’s address, and a request from the owner signed in to the console. Starting over keeps the same subscription and makes a fresh set of team keys:

1. We tell you what will happen, and you confirm: nothing is carried over to the new keys automatically.
2. A new admin sets up the new keys on a Mac, as in Get started.
3. Members re-add what they still have by hand: export it from their Macs before you start (requests, rule and mock sets, sessions) and import it into the new team’s spaces. Vault values have to be entered again. Anything nobody exported is lost.
4. We delete the old keys’ data from Subcloak’s servers by hand within 30 days, and tell the owner when it’s done.

Caution

Keep the Team Recovery Kit somewhere the company won’t lose it, and keep two admins. Without both, starting over can lose spaces for good.

Related

Team keys and the Recovery KitWhat the kit can do and where to keep it.

Invite and approve peoplePromote a second admin.

Security modelWhy Subcloak can't recover a team.