3 ms·
Is there any issue with the Automatic Key Backup feature in Riot? >Once enabled, your device will maintain a secure copy of its keys on your server. To ensure
by meruru 8y ago
Is there any issue with the Automatic Key Backup feature in Riot?
>Once enabled, your device will maintain a secure copy of its keys on your server. To ensure those keys can only ever be accessed by you, they are encrypted on your device, with a key that you either store yourself or secure with a passphrase and upload to your server. It is important to understand that to protect your privacy your keys will never touch the servers unencrypted.
https://medium.com/@RiotChat/the-big-1-0-68fa7c6050be https://medium.com/@RiotChat/the-big-1-0-68fa7c6050be
- AmericanChopper 8y agoThis is probably the most elegant solution to achieve that functionality, but it still has a few security downgrades. To back up the keys, you either need to manage a server yourself, or store them with a 3rd party that you trust. To protect the backed up keys, you either need to manage another key, which just kicks the can down the road, or use a passphrase. If you give your users the option to protect their keys with a passphrase or with a mnemonic word list, a lot of them will pick the passphrase because it’s easier. It’s also less secure, especially if your users choose a weak passphrase, which a lot of them will. I really like the whatsapp solution, because it has all the security under the hood and doesn’t let the users revert to less secure behaviour. It has an obvious UX tradeoff (with lost message history), but the alternative is to downgrade the key management UX to that of managing a cryptocurrency wallet.