Backend runs on Google Cloud Run with containerized deployment via GitHub Actions. The frontend is a Vite/React application with Auth0 authentication and Mapbox for geospatial quests.

Zero-Knowledge

The system is designed so that Quest-Lock never has access to a user’s new password. This is achieved through client-side encryption and a secret-sharing scheme.

1. Password Generation & Splitting:
   • A user plans n quests and generates a new, secure password on the client.
   • This password is then split into 2n cryptographic shares using Shamir’s Secret Sharing.
2. Share Distribution & Storage:
   • All 2n shares are encrypted client-side before any transmission.
   • The user’s device stores n of the encrypted shares locally.
   • The remaining n shares are stored on the server, with each share being locked behind one of the n quests.
3. Reconstruction Threshold:
   • To reconstruct the password, a threshold of k shares is required.
   • The system enforces that k is always greater than n (k > n).

This model ensures that neither the user (with only n shares) nor the server (with only n shares) possesses enough information to reconstruct the password independently. Access requires the user to complete a sufficient number of quests to combine their local shares with the server-held shares, meeting the k threshold.