Remote authentication and passwordless password reset

1. A server comprising:

memory;

first executable instructions;

second executable instructions; and

processor circuitry to execute the first executable instructions to cause transmission of the second executable instructions to a client device, the second executable instructions, when executed at the client device, to cause the client device to:

authenticate a user of a credential management account that is to manage respective credentials respectively associated with user accounts;

obtain a local storage key by decrypting an encrypted local storage key based on a cloud key, the cloud key obtained from a remote authentication server, the cloud key associated with the client device;

decrypt a key bag with the local storage key, the key bag including a content encryption key and an encrypted first credential, the encrypted first credential encrypted with the content encryption key, the encrypted first credential associated with the user; and

decrypt the encrypted first credential with the content encryption key to obtain a first credential associated with a first user account managed by and different than the credential management account, the first credential to be obtained without the user supplying a master password associated with the credential management account.

2. The server of claim 1 , wherein the second executable instructions cause the client device to:

generate the content encryption key;

generate a key encryption key based on the master password of the credential management account and a key salt;

encrypt the content encryption key with the key encryption key to obtain an encrypted content encryption key; and

transmit the encrypted content encryption key to the remote authentication server.

3. The server of claim 2 , wherein the second executable instructions cause the client device to:

encrypt the first credential with the content encryption key to obtain the encrypted first credential;

store the content encryption key and the encrypted credential in the key bag;

generate the local storage key;

encrypt the key bag with the local storage key; encrypt the local storage key based on the cloud key to obtain the encrypted local storage key; and

store the encrypted local storage key in a local storage.

4. The server of claim 3 , wherein the second executable instructions cause the client device to:

generate a device salt corresponding to the client device;

generate an online key encryption key based on the device salt and the cloud key; and

encrypt the local storage key with the online key encryption key to obtain the encrypted local storage key.

5. The server of claim 2 , wherein the second executable instructions cause the client device to not store the key encryption key and the encrypted content encryption key on the client device.

6. The server of claim 3 , wherein the second executable instructions cause the client device to not store the cloud key, the key salt, and the key encryption key on the client device.

7. The server of claim 4 , wherein the second executable instructions cause the client device to not store the cloud key, the key salt, the key encryption key, and the online key encryption key on the client device.

8. The server of claim 1 , wherein the second executable instructions cause the client device to:

derive an online key encryption key based on a device salt associated with the client device and the cloud key; and

decrypt the encrypted local storage key with the online key encryption key to obtain the local storage key.

9. The server of claim 1 , wherein the first credential includes one or more credentials used to log into a website.

10. The server of claim 1 , wherein the second executable instructions cause the client device to authenticate the user of the credential management account based on a biometric authentication factor.

11. The server of claim 1 wherein the credential management account corresponds to an interface to allow the user to access the respective credentials, the first credential to be used to log into a website.

12. At least one of a storage device or storage disk, comprising instructions that, when executed, cause a client device to at least:

authenticate a user of a credential management account that is to manage respective credentials respectively associated with user accounts;

obtain a local storage key by decrypting an encrypted local storage key based on a cloud key, the cloud key obtained from a server responsive to the authentication of the user, the cloud key associated with the client device;

decrypt a key bag with the local storage key, the key bag including a content encryption key and an encrypted first credential encrypted with the content encryption key, the encrypted first credential associated with the user; and

decrypt the encrypted first credential with the content encryption key to obtain a first credential associated with a first user account managed by and different than the credential management account, the first credential to be obtained without the user supplying a master password associated with the credential management account.

13. The at least one storage device or storage disk of claim 12 , wherein the instructions cause the client device to:

generate the content encryption key;

generate a key encryption key based on the master password of the credential management account and a key salt;

utilize the key encryption key to encrypt the content encryption key to obtain an encrypted content encryption key; and

transmit the encrypted content encryption key to the server.

14. The at least one storage device or storage disk of claim 13 , wherein the instructions cause the client device to not store the key encryption key and the encrypted content encryption key on the client device.

15. The at least one storage device or storage disk of claim 13 , wherein the instructions cause the client device to:

encrypt the first credential with the content encryption key to obtain the encrypted first credential;

store the content encryption key and the encrypted first credential in the key bag;

generate the local storage key;

encrypt the key bag with the local storage key;

encrypt the local storage key based on the cloud key to obtain the encrypted local storage key; and

store the encrypted local storage key in a local storage.

16. The at least one storage device or storage disk of claim 15 , wherein the instructions cause the client device to not store the cloud key, the key salt, and the key encryption key on the client device.

17. The at least one storage device or storage disk of claim 15 , wherein the instructions cause the client device to:

generate a device salt corresponding to the client device;

generate an online key encryption key based on the device salt and the cloud key; and

encrypt the local storage key with the online key encryption key to obtain the encrypted local storage key.

18. The at least one storage device or storage disk of claim 17 , wherein the instructions cause the client device to not store the cloud key, the key salt, the key encryption key, and the online key encryption key on the client device.

19. The at least one storage device or storage disk of claim 12 , wherein the instructions cause the client device to:

derive an online key encryption key based on a device salt associated with the client device and the cloud key; and

decrypt the encrypted local storage key with the online key encryption key to obtain the local storage key.

20. The at least one storage device or storage disk of claim 12 , wherein the first credential includes one or more credentials used to log into a website.

21. The at least one storage device or storage disk of claim 12 wherein the credential management account corresponds to an interface to allow the user to access the respective credentials, the first credential to be used to log into a website.

22. The at least one storage device or storage disk of claim 12 , wherein the instructions cause the client device to authenticate the user of the credential management account based on a biometric authentication factor.

23. A method comprising:

authenticating a user of a credential management account that is to manage respective credentials respectively associated with user accounts;

obtaining a local storage key by decrypting an encrypted local storage key based on a cloud key, the cloud key obtained from a server, the cloud key associated with a client device;

decrypting a key bag with the local storage key, the key bag including a content encryption key and an encrypted first credential, the encrypted first credential encrypted with the content encryption key, the encrypted first credential associated with the user; and

decrypting, by executing an instruction with processor circuitry, the encrypted first credential with the content encryption key to obtain a first credential associated with a first user account managed by and different than the credential management account, the first credential to be obtained without the user supplying a master password associated with the credential management account.

24. The method of claim 23 , further including:

generating the content encryption key;

generating a key encryption key based on the master password of the credential management account and a key salt;

encrypting the content encryption key with the key encryption key to obtain an encrypted content encryption key; and

transmitting the encrypted content encryption key to the server.

25. The method of claim 24 , further including not storing the key encryption key and the encrypted content encryption key on the client device.

26. The method of claim 24 , further including:

encrypting the first credential with the content encryption key to obtain the encrypted first credential;

storing the content encryption key and the encrypted first credential in the key bag;

generating the local storage key;

encrypting the key bag with the local storage key;

encrypting the local storage key based on the cloud key to obtain the encrypted local storage key; and

storing the encrypted local storage key in a local storage.

27. The method of claim 26 , further including not storing the cloud key, the key salt, and the key encryption key on the client device.

28. The method of claim 26 , further including:

generating a device salt corresponding to the client device;

generating an online key encryption key based on the device salt and the cloud key; and

encrypting the local storage key with the online key encryption key to obtain the encrypted local storage key.

29. The method of claim 28 , further including not storing the cloud key, the key salt, the key encryption key, and the online key encryption key on the client device.

30. The method of claim 23 , further including:

deriving an online key encryption key based on a device salt associated with the client device and the cloud key; and

decrypting the encrypted local storage key with the online key encryption key to obtain the local storage key.

31. The method of claim 23 , further including accessing the first credential via the credential management account, the credential management account corresponding to an interface.

32. The method of claim 23 , further including authenticating the user of the credential management account based on a biometric authentication factor.