3 ms·
> Have the customer provide an SSH/GPG public key, and store it with the account. Doesn't this just move the problem from "I forgot my password" to "I lost my
by stordoff 11y ago
> Have the customer provide an SSH/GPG public key, and store it with the account.
Doesn't this just move the problem from "I forgot my password" to "I lost my private key"?
- stephenr 11y agoHigher security has some potential downsides. If you enable 2FA on an account with a service, and subsequently lose access to 2FA otp's (e.g. phone lost/wiped/etc) and lose access to (or never kept) the recovery codes, you generally lose access to the account. This is similar, but with the benefit that you can keep the key secure by default - i.e. put a passphrase on the key and then store it wherever you like. In reality, if you fail this "recovery" method, my next suggestion would be a billing based one (i.e. talk to a human, get confirmation of previous invoice details, what is being billed for, how it's paid for, etc)