Two PINs, two vaults: how the second PIN works
Short answer. ZeroBox can keep a second, separate vault behind a second PIN. One PIN opens one vault, the other PIN opens the other. It gives you a believable answer if someone watches you unlock your phone. It is not a guarantee, and the page below says where it stops.
How it works
In Settings you set a second PIN. It must be the same length as your own PIN, so the length gives nothing away.
The second vault is a real vault. It has its own files and its own albums. The app keeps the two apart: opening the second one does not unlock the first.
The second PIN can be changed later, and its files stay. If you set up a second vault again from scratch, the old one and all its files are replaced and cannot be recovered. The app warns you before that happens.
Fingerprint and recovery keys
The fingerprint opens the vault for which you turned it on last. If you want a PIN every time, use the setting "Require PIN after fingerprint".
Each vault has its own recovery key. The key of the second vault opens only the second vault, and the app tells you to keep it separately from the other one.
A transfer file for a new phone carries one vault. The second vault and the fingerprint are not included, so you set them up again on the new phone. If you protect the file with the recovery key, your paper key keeps working. If you protect it with a PIN, the recovery key is not included either.
What this does not protect
- A forensic expert with full access to the phone may still find traces that ZeroBox cannot control. The app says so itself: the idea is strong, not absolute.
- Someone who compares copies of the phone's storage taken at different times may notice that the data grew or changed. This is a known limit of the design.
- The check that the two vaults really leak nothing to each other is not finished. Our own threat model lists it as open, so treat the separation as a design goal, not a proven fact.
- How long unlocking takes is a small signal we have not removed.
- It does not stop someone from forcing you to delete the data or the app. The second vault does not help against that.
Questions people ask
Why must the second PIN be the same length as the first?
If the lengths differed, the length alone would tell an observer that there is another PIN. Equal length removes that clue.
Is the second vault just a fake folder?
No. It is a full vault with its own files and albums, kept apart from the first.
What happens if I set up the second vault again?
The old second vault and all its files are replaced and cannot be recovered. The app asks you first, and tells you to enter the current second PIN if you want to keep it.
Does the fingerprint open both vaults?
It opens the vault for which you turned it on last. To be asked for a PIN every time, turn on "Require PIN after fingerprint".
Does a recovery key cover both vaults?
No. Each vault has its own recovery key. Keep them in different places.
Can I move both vaults to a new phone?
A transfer file carries one vault. Move the one you choose, then set up the second PIN again on the new phone.
Related
- Forgot your vault PIN or got a new phone? How ZeroBox recovery works
- Is a vault app really encrypted, or does it just hide your photos?
- Moving your vault to a new phone
