1. As said, this is not the best place to advertise your project, hence you should move the topic.
2. What stops you from conveniently log/store the information you get before (API keys) or after (policy number) encrypting it? If you want to tell about IP blacklist, read 4.
3. What stops the trusted person use the policy number and withdraw - sooner or later - those funds like he would have the API keys himself? (excepting IP)
4. From what I see the only security measure would be that the Binance account API keys work only with a small list of IPs. I don't have experience with the API keys, but I don't expect "the next generation" will be able to enter from the exact whitelisted IP. Most households have dynamic IP, hence the Binance account will have to allow IP ranges or everything (if that's possible), hence allowing the funds get stolen (see [2] and [3]).
Am I missing / misunderstood something?
We have written many times that users be sure to include a whitelist. The policy will not be generated if you do not check the corresponding checkbox.
The recipient of funds does not need to worry about keeping a static IP address. The policy can be used from any device with any IP address. Before creating a policy, the owner of the Binance account in the whitelist enters the static IP address of the KeycoSafe server. We will make sure that this address never changes.
If the policy is stolen, the attacker will need to somehow change the recipient's address in the policy. This cannot be done without decrypting the policy, which can only be done on the keyco server. The policy is protected by RSA encryption with a 4096-bit key. The attacker will also need to change the recipient's address in the exchange whitelist, and for this he will need access to your Binance account. Considering the above, we believe that there is no point in stealing and trying to decrypt the policy, because you will not be able to withdraw coins to any wallet other than the one specified in the policy (taking into account the observance of the recommendations described on the keyco.io website).
We don't need to store any information (API keys, recipient address, etc.). All this information is encrypted in the policy itself and is not stored in any logs, databases, etc. When using the policy, this information is decrypted, funds are withdrawn to the recipient's wallet, and the information is immediately deleted. It makes no sense for us to save the user's API keys in order to steal funds, since no one (including us) will be able to withdraw funds to a wallet other than the wallet specified in the whitelist of the exchange.
We plan to introduce policies with deferred use, for example, one year after creation or with an indication of the start date of the policy. Thus, the heir will not be able to use the policy until this date. Or you can use any other services for deferred messages, emails, SMS.
