# Bingo: A Semi-Centralized Password Storage System
## 5 System Architecture
### Bingo Proxy
A visualization of the cryptographic methods employed for each share can be found in Figure 4.  
Figure 3: Shamir Secret Sharing for N = 5 and T = 3. In order to distribute shares during a registration workflow, Bingo Proxy chooses a set random number of active peers P, which is calculated by multiplying N by a configured replication factor R. Each domain configures R in order to further balance availability and security. Each share is distributed R times among the network, thus increasing the likelihood of the share being available for retrieval during a login workflow. As with setting the SSS threshold T, if R is set too high, then an attacker can more easily accumulate a user's password shares by attacking fewer devices. Note that Bingo Proxy does not distribute shares solely among other users associated with the same domain. Rather, any active peer in the entire Bingo network may store a share, regardless of which Domain the user behind said peer is associated with. This is done for two main reasons. First, a lack of selectivity in choosing peers for share distribution and retrieval generates higher availability, allowing all online services to essentially collaborate with one another through their shared usage of Bingo. Second, anonymizing peers in regard to which domain they are used to authenticate with simplifies the Bingo Proxy architecture as well as the user's workflow. Much like 2 FA providers, Bingo users only require one tool to authenticate with all online services which use it for authentication. With that said, a private deployment of Bingo may allow selectivity in choosing peers for distribution and retrieval of shares, but this is beyond the scope of this work. In Bingo Proxy's basic form, peers are chosen randomly for distribution. We leave the task of improving this distribution method for future work. We propose a distribution scheme which selects peers based on the amount of time they have been active. By choosing more active peers, Bingo Proxy makes a gamble that the user being managed by this peer is likely to be active for longer periods of time throughout the day, and thus, the user is more likely to be able to retrieve shares on demand. In any case, a peer is sent a WebSocket distribute event along with the share assigned to it. When the peer has successfully stored the share, it acknowledges the distribution with a distributed event back to Bingo Proxy. When N \(\times\) R peers have acknowledged the distribution, the registering user receives a success status. If not enough acknowledgements are received, the user fails to register. During a login workflow, Bingo proxy queries all active peers in the network for a share assigned to the Domain ID and User ID by broadcasting a retrieve event. Any active  
Figure 4: Cryptography used for distributed secret shares. peer storing a share which matches both identifiers respond with a retrieved event along with the corresponding share. When T unique shares are retrieved by the network, the aforementioned login API route for the Domain is called, and the user is successfully logged in along with the contents of the API call's response, which should include a third-party API key. The following elaborates on Bingo Proxy's job system, which aims to provide an elegant programming interface for registrations and logins which are asynchronous in their nature, and may require numerous attempts to succeed. 1. Job Service: In order to limit the negative effects on system availability caused by a fluctuating number of active peers at any given time, Bingo Proxy implements user workflows as \"jobs\" which run asynchronously and deliver results upon completion. The current implementation of Bingo Proxy provides two job interfaces: Distribution Job for registrations and Retrieval Job for logins. During a workflow, a corresponding job is initialized with all necessary information to be provided to peers, along with a callback function which is used once the job either succeeds or fails.