3 ms·
The forget/lose/destroy passphrase isn't too hard to solve: - 0server reset is possible through PBKDF2 & AES backup (https://www.youtube.com/watch?v=xFR8cx7jB1
by marknadal 8y ago
The forget/lose/destroy passphrase isn't too hard to solve:
- 0server reset is possible through PBKDF2 & AES backup (https://www.youtube.com/watch?v=xFR8cx7jB1c https://www.youtube.com/watch?v=xFR8cx7jB1c)
- You can improve the design in the above video with a threshold algorithm, where you only need to get X >= Y of reset tokens correct (Y should be high enough for entropy, and X is enough for your memory to be accurate).
- Or the model I most/best prefer, is doing multi-part social-proof backup login. Aka you have 3+ friends (or services, if you don't trust your friends?) who when combined together can unlock a backup of your key.
These systems work, and I'm confident you'll see even centralized systems convert to them (we're already seeing Facebook do it) for higher security.
Martti 'Sirius' Malmi, Satoshi's 1st contributor to Bitcoin, also has joined our team to work on solving problems around this - like, if you need to trust 3 of your friends, how do you actually have a guarantee that those are* your friends' pubkey, not some imposter account, especially because consumers won't be good at copying/checking pubkeys. He's already got a bunch of code for it working: https://github.com/identifi/identifi-lib https://github.com/identifi/identifi-lib
* how the PBKDF2 & AES backup works: http://gun.js.org/explainers/data/security.html http://gun.js.org/explainers/data/security.html (couple videos in, each only 1min long)