Password managers do more harm than good when it comes to securing your organization's most critical systems and data. 

From storing master passwords in plain text, to leaving users susceptible to keylogging and phishing attacks, to users still choosing sharing weak passwords — password managers are ineffective solutions that fail to address the inherent security risks associated with passwords. 

Instead they provide a cover-up solution that only masks the real problem: passwords are a weak and ineffective method for authenticating users in the digital world, and reliance on them to authenticate users puts everyone at risk.

Memorized secrets shared between user and platform, better known as passwords, are the biggest design flaw of the internet. Hackers have been figuring out ways to crack passwords since the sixties.

Today, cyber threats are growing increasingly sophisticated, yet the way we authenticate has not evolved. Instead of rethinking how to authenticate and identify users, cybersecurity has centered around bolstering the password so that it is less susceptible to security threats. Unfortunately, none of these solutions addresses the fundamental problem: so long as there is a “password”, there is something for hackers to guess or steal.

“Password fatigue” describes the overwhelming burden users experience when it comes to managing their accounts. With the average user having an estimated ninety separate accounts — mandatory password changes, and complex password requirements backfire — forcing users to choose weak passwords that they can easily remember.

Password managers aim to solve the issues caused by password fatigue. They take memorizing passwords out of the hands of users, so that they can choose more complex passwords that meet password guidelines and policies.

How come password managers do more harm than good?

While password managers may solve issues with password fatigue, by allowing users to choose more complicated passwords, 

 against an onslaught of password-related attacks — like password phishing, keylogging attacks and Man-In-the-Middle attacks.

Password managers actually collate all of a user’s private credentials and store them in a single, centralized place. Just like other centralized platforms, password managers are vulnerable to being hacked. If a malicious actor manages to successfully break into the password manager, then all the stored credentials will be breached.

Password managers have known security flaws. What are they?

If a hacker gets access to the password management system, they gain unlimited access to the credentials stored within it. Independent research of some of the most popular password managers highlights clear security vulnerabilities.

master password was stored in plaintext on the user’s device

; for a savvy hacker, backdoors like this become easy hits. In fact, hackers are actually more inclined to attack password managers: For users, a breach would be a huge inconvenience that could lead to fraud and identity theft and loss of access to accounts. For an organization, this could be catastrophic.

Password managers are also vulnerable to attacks launched by “rogue” apps — fake apps designed to look like the real deal. Researches at the University of York fooled 

40% of password managers into giving away passwords

1. Password managers provide a false sense of security

Unfortunately, employees still choose their passwords, and ultimately decide how they manage them. For example, an employee could put corporate systems at risk by sharing their password around, or choosing a common password. Password managers can also be added by employees without the organization’s consent.

2. Password managers fail to solve resource and budget issues associated with passwords 

Password managers also fail to eliminate costs associated with maintaining passwords. These costs can be a heavy burden on businesses. The average cost of password reset is US $70, and in the midst of the pandemic, these costs have put massive financial strain on businesses. According to Security Brief, online retailers 

It’s not just password managers that pose a risk to security — all security solutions aimed at bolstering passwords adds further complexity to the issue, disrupting the user-journey and creating new entry points for attacks.

In order to properly safeguard systems and private data, we need to completely overhaul the way we authenticate.

At Keyless, we use a combination of advanced cryptographic techniques to eliminate fraud, phishing and credential reuse — all while enhancing customer and employee experiences and protecting their privacy. Our biometric authentication solution offers multi-factor security across devices and platforms with just a look.

Interested in trialing Keyless to secure your remote workforce?

If you’re interested in how Keyless™ authentication can help deliver secure and seamless digital experiences, whether for your end-users or for an ever more important and dynamic digital workplace, or if you’d simply like to learn more about our platform, then please feel free to get in touch with our team. You can email us at 

We’re always keen to have a chat about how we can help businesses on their journeys towards a complete zero-trust security model.

Password managers are just a band-aid solution to a deeply-rooted problem with authentication

How to protect your company, employees and customers against fraud and phishing.

phishing attacks around the world rose by over 600%

.  The sudden shift, along with a lack of adequate cybersecurity training, the unprecedented use of personal devices for work, and sheer volume of personal data being shared on the web created new opportunities for bad actors and scammers.

Today, it's relatively easy to gather information about someone – for example from their LinkedIn profile – allowing bad actors to launch increasingly elaborate attacks. Exploiting our anxieties and fear, bad actors trick their victims into handing over sensitive account data (like their usernames and passwords), or downloading malicious software onto their devices.

So what's the best defence against phishing, account takeover fraud? 

Cutting out the lowest hanging fruit: passwords .

Phishing is a type of attack that aims to compromise a user’s sensitive information. Usually, hackers masquerade as a legitimate business, entity or person, tricking the victim into opening an email, link or downloading an attachment.

Most often, phishing attempts seek to compromise sensitive information like login credentials or credit card details.

Sometimes the goal of a phishing attack is to install malicious software onto the victim’s device. Once installed, the hacker is able to control the user’s device, allowing them to launch further attacks that infect more devices. Malware has the potential to compromise the private data in an entire network.

Phishing falls under the broader umbrella of “social engineering” — a term that describes the use of deceptive means to trick victims into divulging sensitive information that can be used for fraud and other illegal purposes.

Most phishing attempts are made via email, however with the adoption of smart devices, attacks launched via text, social media and digital advertising are rising.

The most common kinds of phishing attacks

A vast majority of phishing attacks are launched via email. These emails are designed to masquerade as a legitimate entity. To do this, hackers register an email address that looks legitimate and then use that address to launch thousands of phishing emails to a database of users.

These are usually stolen or obtained through the dark web, however with so much personal information being made online, it wouldn’t be too hard for smart criminals to create their own databases.

In 2020, there was an explosion of attacks impersonating government and healthcare officials – preying on people’s anxieties and fears about the virus and its economic consequences.

Spear phishing is a more sophisticated form of phishing where the hacker targets a specific person. To launch these attacks, hackers have usually obtained some of the victim’s personal information, like their name, job description and employer, email address and so on.

Today, this information is freely available to the public through social media channels like LinkedIn, so obtaining it is easy, posing a real risk to individuals, businesses and public entities.

In these attacks, hackers usually send emails or direct messages to victims impersonating their colleagues or superiors. Because the victim trusts the person who’s had their identity hijacked, they are more likely to click on malicious links/download malicious attachments.

With remote work now a reality, spear phishing attacks targeted specifically at employees pose significant risks to corporate security.

Whaling attacks are similar to spear phishing attacks, except that they are target high-ranking members of an organization or corporation.

Hackers masquerade as senior executives, or other individuals in powerful positions, like politicians or well-known journalists, to try and trick the victim into divulging sensitive information.

Whaling attacks can be highly sophisticated and drawn out, with hackers devoting weeks or months of their time establishing trust with the victim, before finally launching their attack.

Smishing and vishing attacks are where hackers either text or call the victim. They either send malicious links via text message, or they call the victim impersonating an official from a bank or government agency. The primary purpose of these attacks is the same, to get the victim to disclose sensitive information — usually usernames and passwords or credit card details — to the hacker.

In times of heightened public anxiety, these kinds of attacks can be extremely effective. For example, hackers are taking advantage of the COVID-19 pandemic to send

These work as governments will from time to time send mass health or weather alerts via text. If the victim clicks on the link, it could either take them to a false website, or it could install malicious software onto their devices, allowing the hackers to launch further attacks.

Angler phishing is virtually the same as all other phishing attacks, except the hacker takes a different route of attack — through social media and private messaging apps.

With the amount of personal information users share online, coupled with the lower barriers to entry for making a fake persona, hackers are able to easily clone social media profiles to create believable spoof accounts, or entirely new aliases.

They can then use these accounts to send malicious links to victims, or they can impersonate trusted friends and family members, getting the victim to divulge sensitive information, like passwords or credit card details.

How can you protect your business from phishing attacks?

Most advice for stopping phishing scams online reads the same, don’t open suspicious emails or attachments. While this is all great advice, one of the best ways to protect your corporate network and company data from being compromised is to change the way that you authenticate your employees, users and partners.

The link between phishing and stolen credentials

Passwords are the gateway to our personal life on the web, yet if the internet had one distinguishable flaw, it would be passwords. The web as we know it is fraught with security threats that are all designed to steal login credentials. Yet, despite the overwhelming risks, poor password hygiene is rampant. It’s not the user’s fault; maintaining proper control over passwords has become impossible thanks to users having hundreds of accounts that all have their own varying requirements. This coupled with mandatory password updates has caused password fatigue — prompting users to recycle their passwords, using the same password across platforms or slightly different variations of it.

Hackers exploit this; they know that it only takes a single compromised password to unlock access to a user’s entire digital life. Once they have this “key” to the user's online world, hackers can launch all kinds of attacks. This poses serious threats to businesses as their employees transition to remote work.

Put a stop to phishing for good by adopting passwordless 

Switching to passwordless authentication eliminates the security risks associated with weak login credentials like usernames and passwords, as well as solving the security risks with one-time passwords like SMS-2FA.

Phishing is much less of a threat if there are no passwords to steal from your employees or users. When they are removed from the equation, passwords can’t be stolen and used to launch other attacks.

If your corporate systems do become compromised by malware, switching to

also greatly reduces the chances of sensitive user data being stolen in a breach. If a large-scale breach was successful, hackers would find that there are no login credentials to steal, making your business less of a target.

Everything you need to know to protect your business from phishing attacks

The pandemic has forced offices all around the world to adjust to remote working. Unfortunately, remote environments introduce unique security challenges that need to be dealt with.

To help protect companies during this period of unease and uncertainty, we’ve listed our top tips for implementing remote-work security:

1. Utilize secure collaboration tools and set clear communication guidelines

Some employees may never have worked from home before, meaning that they don’t have the prior experience to gauge what a “normal” method for communication is from their colleagues now that they are out of the office.

Hackers will no doubt be looking to take advantage of this — and may seek to impersonate members within your organization. Implementing official communication guidelines and using more secure collaboration tools like Slack will help ensure your employees are not tricked into disclosing sensitive information to criminals.

2. Teach your employees to spot phishing and malware attacks

Phishing is one of the top cybersecurity threats to businesses, responsible for roughly 

 of all breaches. With criminals looking to exploit public anxiety, coronavirus-related phishing attacks are on the rise, with 

 being created daily that aim to compromise the login credentials of remote-workers.

Malware attacks usually come in the form of infected files. If these are downloaded, they can allow a malicious party to control the users device, and can even infect other devices using the same network.

Training employees to detect potential phishing and malware scams is essential to implementing remote-work security. Implementing passwordless authentication is another tactic for securing your corporate systems from malicious takeover.

3. Train employees in cybersecurity hygiene

There are basic measures every remote worker can take to protect themselves and their devices from targeted cybersecurity threats. Some of the most crucial yet simple things you can teach your employees are: the 

 by changing the default passwords, and why regular 

4. Secure your business VPN by turning on multi-factor authentication (MFA)

If your employees aren’t already using a VPN to access your company’s private systems, then they should be.

, is just that, a private network. VPNs reroute all web activity so that it passes through a private network. These are generally protected with robust security systems. Generally speaking, VPNs are far more secure than any network your employee may be using while they work from home.

5. Implement mandatory multi-factor authentication (MFA)

If you haven’t already, you should make multi-factor authentication (MFA) mandatory for all of your businesses systems. While it may be frustrating for employees to continuously authenticate throughout their working day, MFA is a critical defence against hacks and unauthorized access to your company’s systems.

Keyless offers seamless, biometric authentication. You can read more about it 

6. Implement a passwordless authentication solution, like Keyless

Keyless offers military-grade biometric authentication solutions for the enterprise. Our solution eliminates passwords, allowing employees to access business systems and applications by using their unique biometrics.

Eliminating passwords helps minimize the consequences of phishing attacks, as criminals no longer have passwords to steal.

Our platform is designed to be ubiquitous — meaning it can be integrated with all operating systems, and can be installed on any smart-device with a built in front-facing camera.

Additional tips for protecting your business 

7. Review who has privileged access to your IT systems

Unfortunately, most cyber attacks launched against businesses are perpetrated by employees. That’s why it’s an important time to review who has privileged access to your corporate information systems, and limit all unnecessary privileges where possible.

A privileged user is someone with a relatively high level of access to a company’s corporate information systems. Usually employees with privileged access system administrators, database administrators, developers, architects, application owners, and IT managers.

8. Teach employees how to backup data to avoid lost work

Unfortunately, when employees work from home there is a risk of important work being lost, whether due to system crashes or misplaced devices. Consider investing in automated cloud-based backup and recovery systems for the time being. This will help ensure that important work and systems changes aren’t lost.

9. Teach your employees how to encrypt their data

With employees now working from their personal devices, it’s likely that there will be some point in time that your private files will end up on their personal computers or mobile devices. This poses a big security risk if the computer is somehow taken over by a malicious party.

That’s why it’s important to teach your employees how to encrypt their “at-rest” data.

Most modern devices actually have in-built encryption functionality. For Mac’s 

10. Implement a “lost/stolen devices” policy

If an employee loses their personal device, they may not think to tell you. The failure to report a lost/stolen device can put your company at significant security risks, and is considered failure to report a data breach in some jurisdictions.

It’s important to remember that data-privacy laws are still in effect. In most jurisdictions, you only have 72 hours to report a data-breach before you risk being fined. having to pay hefty fines. To help protect your business against the significant financial and reputational costs of a data breach, it’s important to implement processes so that your employees report any potential breaches as soon as possible.

11. Have processes for reporting suspicious activity

Perhaps your employee got a suspicious email, or a strange phone call. Perhaps they opened a link. Whatever it is, you should not only train your employees to spot potential threats, you should implement processes for reporting them.

It’s likely that hackers will target multiple employees in an organization. Having such processes in place will help your security teams investigate and intercept attacks sooner.

While a rushed transition to remote-working environments may have caught many businesses off-guard, there are simple steps that your business can take to safeguard your corporate systems while working from home.

How to protect your company from cybersecurity threats during the COVID-19 pandemic

Authentication is a process used to verify that someone is who they claim to be. Each of us completes the process of authentication multiple times a day. 

In fact, authenticating ourselves has become so ingrained in our everyday lives, that most of us don’t give a second thought to what we’re actually doing in the process.Unlocking our devices, entering our PIN numbers, swiping into our office buildings, scanning our passports at airports — these are all acts of authentication. We’re proving who we are, or that we have ownership over something, to a platform or service.

In this piece, we’re going to delve into the evolution of online authentication methods and the inherent security problems with how our private credentials are managed by companies today. We’ll then focus on how our team is leveraging the latest advancements in cryptography and biometrics to work towards building a privacy-focused future.

The evolution of online authentication methods

Technology has evolved at an incredible speed since the launch of the World Wide Web in 1991. So much so that today, our entire lives entirely revolve around mobile devices and the platforms on them. Today most of us work, socialise, make payments, shop for groceries, and even bank online.

Yet, the way we authenticate online and manage private information has failed to evolve at the same pace. Despite being introduced over half a century ago, usernames and passwords are still the most popular authentication method used today.

Usernames and passwords have been the most common form of online authentication for decades. Users choose a “secret”, an easy to remember password that nobody else knows.

The password is shared with the platform or service, and then stored on their internal systems so that it can be cross-referenced when someone attempts to login.

While still the most popular means of authentication on the internet, guessing passwords has proven to be relatively easy. To protect users against this, most platforms have imposed their own set of password requirements, some more lax than others, and most require user’s to change their passwords periodically.

This strategy has arguably made it harder for users to keep their passwords secure. In reality, being forced to remember dozens of different password combinations forces users to either overuse the same password, or keep copies of them stored in insecure places.

Hashing is a one-way encryption function that’s used by platforms to securely store passwords. With hashing, raw or unaltered passwords are transformed into an unrecognizable alphanumeric “hash”.

The one-way function makes it more difficult for an attacker to uncover a user’s password.

To authenticate a user, passwords entered during login are converted to a hash, and then the system compares that with the stored hashed copy saved on file. If there is a match, then the user is granted access.

Unfortunately, hashing alone is generally not strong enough to completely dissuade malicious actors, as cybercriminals can still steal hashed passwords from databases.

These can be easily broken by a dictionary attack, or by brute force attacks where the malicious party plays trial and error until they discover the original password or secret.

1980s: Two-factor authentication — Hardware tokens

Two-factor authentication (2FA) is essentially the idea of presenting the user an authentication challenge that is 

 to the first. This creates another security perimeter that hackers need to bypass, making it much more difficult to break into a user’s accounts.

Hardware tokens are registered to a user’s accounts, and produce one-time passwords (OTP) were introduced as a method to do this. Essentially, the user’s possession of the hardware token is another challenge.

If the user knows their username and password, and has possession of the hardware token, then the service can be sure that the user is who they say they are.

Hardware security tokens like YubiKey, are modern examples of 2FA solutions that still use this technology today.

Unfortunately, hardware token solutions are costly, disruptive to the user experience, as they can often be misplaced or lost entirely.

Widely used today amongst those that own digital assets, public key cryptography relies on pairs of “keys” to authenticate users: one private, and one public. Keys are random alphanumeric numbers that are so long and random that they’re considered impossible to guess (or remember).

Instead of needing to store a user’s private information to be able to authenticate them, the only data that systems must store is the 

 along with a username. To authenticate, a server sends a message to the user’s device, and the user creates a digital signature with their private key.

This technique, while more private and secure than other authentication methods, is particularly disruptive to the user-experience.

Since they are so long, private keys are therefore difficult to remember without writing them down and storing copies somewhere. Storing private keys puts them at risk of being compromised or lost, which means user’s not only risk having their account breached, they risk accidentally locking themselves out of their accounts.

2000s: The evolution of 2FA to SMS and soft tokens

As sales of mobile devices sky rocketed, 2FA solutions that leverage mobile devices, rather than secondary hardware devices, rose in popularity. As a secondary authentication challenge, SMS 2FA solutions send a one time password to a user’s pre-registered mobile number.

SMS passwords have proven to be relatively expensive for businesses, susceptible to social engineering attacks, and disruptive to the user-experience if the user loses access to their phone.

Instead of sending an OTP to a user’s phone number, soft tokens leverage the technology built into a user’s smart-device to generate an OTP. While this is less costly for businesses, soft tokens are still vulnerable to security breaches if the user’s device is hacked.

In the last decade, the use of fingerprints and facial recognition technology became pervasive in mobile banking, cloud-based mobile payments, accessing government services and remote working.

Today, users can opt to use their biometrics to authenticate on their registered smart- devices, which then gives them access to the services and platforms within the device.

Instead of being ubiquitous however, mobile-based biometric solutions available today are restricted to specific brands or platforms. For example iPhone users are only able to use their FaceID and TouchID with platforms that have integrated with Apple.

While biometrics solve the problem of having to remember and manage countless passwords, however biometric data is just as vulnerable to being leaked or compromised in breaches, with the risks being significantly higher for both businesses and users.

One of the biggest security challenges with authentication over the decades has been how private credentials are managed. Generally, businesses and platforms store copies of our passwords, PINs and security questions, alongside our personal details. This practice of storing private information in centralized databases essentially creates “honeypots” of our personal data.

These entice hackers to execute large-scale cyber attacks and unfortunately, many attacks are successful, despite the best security efforts of the platform.

We want to overhaul the way we interact with digital platforms. By disrupting the ways in which businesses manage personal information, we hope to enable a world where anyone can seamlessly access any digital service from any device at any time. All while keeping personal credentials safe, private and under control.

Keyless is a deeptech cybersecurity company founded by experienced entrepreneurs and leading security experts. Backed by top-tier venture capitalists, our team is 

bringing over a decade of research in biometrics and privacy-preserving cryptography to life.

Our platform features everything businesses need to embrace passwordless with Keyless biometric multi-factor authentication across the enterprise and enable PSD2-compliant strong customer authentication with just a look across all customer touchpoints, with built-in privacy protections that allow individual users to control their own identity data.

With Keyless, personal data is kept private and secure by combining 

privacy-enhancing multi-party computation

 and zero-knowledge proofs with machine learning, and by leveraging a unique combination of multi-modal biometrics and user behavior modeling. Our zero-knowledge distributed architecture removes the risk of data being compromised in an accidental data breach or targeted cyber attack.

The combination of biometrics with our patent pending privacy-enhancing security technology has the power to completely transform the way that we relate to the web and the world around us. By disrupting the ways in which we authenticate, not just online but in the physical world too, we can make the world more secure and private than ever before.

We see a future where anyone can seamlessly access any service from any device at any time. All while keeping their personal credentials safe, private and under control.

With Keyless, the authentication experience will become frictionless and ubiquitous for users no matter where they are or what they’re doing. At the same time, businesses will no longer need to choose between improving the user-experience or strengthening security.

In a Keyless world, users won’t need to remember anything. Instead, their unique biometric profiles will become their passwords, allowing them to access any service at any time, without needing to worry about their privacy being compromised.

Interested in trialing Keyless to enable secure work from home in a seamless and compliant way?

If you’re interested in how Keyless™ authentication can help deliver secure and seamless digital experiences, whether for your end users or for an ever more important and dynamic digital workplace, or if you’d like to learn more about our platform, then please feel free to get in touch with our team.

From authentication to the future of identity

An introduction to this privacy-preserving cryptographic technique and how Keyless is using it to transform the way we share and store private data across the internet.

Shamir’s Secret Sharing scheme is an important cryptographic algorithm that allows private information— “secrets” — to be distributed securely amongst an untrusted network.

It is one of the cryptographic techniques that Keyless uses to ensure that personal data is kept safe and secure — whether that’s biometric data, private keys or any other personal information that should not be made public.

To understand Shamir’s Secret Sharing, first it’s important to understand what secret sharing aims to achieve.

In cryptography, secret sharing is a way to securely distribute fragments of important private information amongst a distributed network or group, making such schemes particularly useful for safeguarding highly sensitive information like private cryptographic keys or biometric data.

Secret sharing works by splitting private information into smaller pieces — or shares — and then distributing those shares amongst a group or network.

Each individual share is useless on its own but when all the shares are together, they reconstruct an original secret.

Imagine that you had one million dollars that you kept in a bank account, and in order to access this bank account you used to the password: 

You could split it up and distribute a letter each to six trusted shareholders.

s_____, _e____, __c___, ___r__, ____e_, _____t

The only information that each shareholder would have is the letter that they hold, essentially making their individual shares useless.

Secret sharing schemes can also be hierarchical depending on how the shares are distributed. This allows the secret owner to distribute shares based on how much the shareholders are trusted.

Let’s say you wanted to safely store your private key that you used to access your cryptocurrency wallet.

Private keys are used to send cryptocurrency from one address to another. They consist of a sequence of random and unique numbers and are given to users at the time they open a wallet.

Firstly, you wouldn’t want to give anyone the entire sequence, so say you split the key into 

 shares. Then you distribute copies of those shares between your closest friends and trusted family members.

 shares to each of your parents, who you trust without a doubt, 

 each to your brother your sister, who you trust for the most part, and 

 each to eight of your friends, who you somewhat trust.

This hierarchical distribution scheme allows for secret owners to distribute shares based on how much they trust their shareholders.

But what about when there is no trust between the secret owner and the shareholders?

In most schemes an added encryption layer is implemented to ensure additional privacy and security, allowing the shares to be distributed amongst a network or group that are unknown to the secret owner.

Let’s say that each shareholder only holds what seems to be random numbers:

19_____, _5____, __3___, ___18__, ____5_,_____20

) are together, they still require a decrypting key to reveal the secret (

This important step protects private information from organized attacks; even if each shareholder were to collude to recreate the original secret, they wouldn’t be able to learn anything about that secret, as the original secret is encrypted.

Understanding Shamir’s Secret Sharing Scheme

One of the challenges of distributing shares is that they can often be lost or compromised. Shareholders can die, lose their shares or have them stolen. At other times, shareholders themselves turn rogue. When many different shares are distributed, it’s also impractical and inefficient to require all shares to reconstruct the secret.

Shamir’s Secret Sharing scheme is an algorithm that was first proposed in 1979 by the renowned Israeli cryptographer Adi Shamir. It allows for information to be broken into many shares, while only requiring a fraction of those shares to reconstruct the original secret.

This means that, instead of requiring all shares to reconstruct the original secret, Shamir’s scheme requires a minimum number of shares — this minimum is referred to as the threshold.

One of the benefits of Shamir’s algorithm is that it is flexible and extensible — meaning that the secret owner could add, amend or remove shares at anytime if they wanted to, without modifying the original secret.

The threshold needs to be met in order to reconstruct the secret. If there is anything less than the threshold, the secret cannot be reconstructed, thus making Shamir’s Secret Sharing secure against an adversary — a malicious attacker — that has unlimited computational power; in cryptography this is what we call 

 secure simply means that not even an adversary with unlimited computational power would be able to break the encrypted secret.

Using the same example from earlier, say that the threshold to reveal the password is 

19_____, _5____, __3___ = 19,5,3,18,5,20 = secret

It’s important to note that with Shamir’s algorithm, shareholders never find out what the other encrypted shares are in a secret. Only the secret owner has access to the entire set of decrypted shares once the secret is reconstructed.

How Shamir’s Secret Sharing actually works

Shamir’s method for secret sharing relies on polynomial interpolation, which is an algebraic method of estimating unknown values in a gap between two known data points — without needing to know anything about what is on either side of those points.

We will go into further detail on polynomial interpolation in another blog piece, but for the purpose of explaining how SSS works, you can think of it like this:

SSS encodes a “secret” into a polynomial, then splits it into pieces and distributes it It’s possible to use polynomial interpolation to efficiently reconstruct that secret without requiring every single share. Instead only the threshold is needed, which provides enough points of data to correctly estimate the values between gaps in the encrypted shares.

Why Shamir’s Secret Sharing is essential to maintaining data privacy

Blog