Identity and passkeys
ElastOS has no company account to sign up for. Your identity is created on your own computer, from your own keys. No company account stands behind it, so no platform can suspend it. Keep your Recovery Kit safe: it is how you get your identity back if this computer is lost.
Four identities, each with one job
| Identity | What it is | What it is for |
|---|---|---|
| Passkey | A key held by your device (Touch ID, a phone or a security key) | Signing in to your Home |
| Profile DID | Your personal identity, with a signed Profile | How people find you, add you and talk to you |
| Device DID | The identity of one computer, in the form did:key:... | How Homes recognise each other’s computers over Carrier |
| Recovery Kit | A file you save, with an optional password | Getting your account back if you lose every passkey |
ElastOS keeps these separate on purpose. A passkey is not a wallet and not a DID. Losing one does not give someone the others.
Passkeys
A passkey replaces passwords. When you create your account, your device makes a key pair. The private key stays on the device. Home only gets proof that you hold it.
- Sign in with Touch ID, your phone or a FIDO2 security key.
- Admins can add more passkeys in System > Accounts > Add passkey, such as a second device or a security key.
- A passkey belongs to the address where you created it. Use
http://localhost:8090/home/. A passkey made atlocalhostdoes not work at127.0.0.1or at your computer’s network address. - If sign-in fails, the lock screen says why.
DIDs
A DID (decentralized identifier) is an identity that you create and control yourself. Nobody issues it to you.
- Your Profile DID is the identity people use to add you as a contact. You can share it so others can find you. See People.
- Each computer also has a Device DID, in the form
did:key:z6Mk.... It is made from a key on that computer and works without a blockchain.
Recovery Kit
Save your Recovery Kit as soon as you create your account. It is the only way to restore your identity if you lose every passkey.
- Save it in System > Security > Recovery. Keep it somewhere safe and private, like a password manager or an encrypted drive.
- The kit holds your Profile, your Home recovery authority and the keys of your included Wallet. It does not hold your files.
- Anyone who has your Recovery Kit can use it, so treat it like a key to your house. Add a password when you keep funds in Wallet.
- To recover, the person who installed Home gets a one-time code from the computer, then chooses Recover this Home with your Recovery Kit on the sign-in screen. See Data and backup.
If a device or your Profile key is stolen, you need a new identity. Also, importing a Recovery Kit does not yet ask for your passkey again. This is planned.
Accounts on one Home
- The first account on a Home is the admin. Admins manage passkeys, models, updates and security settings.
- Guest accounts are possible when an admin allows them. Guests cannot see the security log or use the Terminal.
- Each account has its own private area:
localhost://Users/....
Today in v2: passkey sign-in, a signed Profile DID, Device DIDs made on your computer, and a Recovery Kit.
Where it is headed: an account DID on the Elastos identity chain (EID) for portable profiles, credentials and globally unique names, and reaching people by their identity. See the roadmap.