20 ms·

From the FAQ: What happens if a user forgets the password? Users should always keep a copy of their password in a safe place, such as a password manager. Since

From the FAQ: What happens if a user forgets the password? Users should always keep a copy of their password in a safe place, such as a password manager. Since the encryption key needs to be decrypted by the user's password, it is not possible to recover an account if the password gets lost. I don't believe this is acceptable for a user authentication service. Password reset functionality must be present for this to be production ready.

Eikon 7y ago
This is a case where usability should trump security in most cases. The final user may even think wanting something like this. Until they ultimately lose their password.
- j-berman 7y ago
  I personally think (and hope) the ever-growing issues surrounding data privacy and the constant stream of data breaches we hear about will push people to demand solutions like this and embrace the tradeoff that comes with it. Hope we get more people using password managers. Hope we get more people thinking more deeply about how they can protect their data. Time will tell what the people want! :) That's my idealistic way of looking at it. Practically speaking, the burden on developers to adhere to GDPR and other data privacy laws is quite high. You can use this service to store sensitive user data and relax :)
  - weego 7y ago
    That'll absolutely not happen in our lifetime if ever. You're projecting your developer centric view onto non-technical users who demand solutions that don't add friction to their lives, if it does it's not solving a problem but just adding a new layer of problems for them.
    - j-berman 7y ago
      Protecting data is solving a problem almost everyone is interested in, including non-technical people. And the existence of password managers disproves your claim regardless. It adds more friction to my life to use a password manager versus an insecure password. We're hitting a very particular tradeoff with this product, one which is largely untapped. We'll see which way the chips fall :)
    - ec109685 7y ago
      So not true. Browser and OS vendors recognize this problem. “Store this key securely and provide it to me” makes sense to implement, so websites can take advantage of all the hardening and security features of the device versus hoping someone doesn’t share a password between two sites.
  - tzjmetron 7y ago
    This sounds bad.
j-berman 7y ago
Userbase dev here Yes, this is a thorny issue. We chose to offer a service that keeps user data end-to-end encrypted by default. With that choice comes this tradeoff. And it’s a tradeoff similarly offered by practically every other end-to-end encrypted service I’m aware of. That being said, we have plans to alleviate the weight of this tradeoff, and we’ve already written nearly all of the code. That code is pending a security review and further refinement. The high level summary of it right now is: 1. you as the developer can opt to keep the user’s key stored in plaintext in local storage (via a single parameter passed to our signIn() method) 2. if a user forgets their password, they can get a temporary password emailed to them, then use it to sign back in 3. the user can then change their password normally
- paublyrne 7y ago
  If your product is SAAS aimed at helping to add authentication to simple apps with low lift, then I think it's a real problem. If I use this product in my product and my customer loses access to her account, then it becomes my problem, and my customer won't want to hear that I can't get their access back.
  - j-berman 7y ago
    Agreed it would be a problem for a developer to use Userbase as is and not understand this is a tradeoff. I take it you think it's not clear this is a tradeoff, which is an issue, duly noted :) However, your customers also don't want to hear that you were hacked and all their sensitive data is now in someone else's hands. We offer easy-to-use protection from that increasingly common scenario. You (and your customers) also presumably don't want you to break privacy law regulations storing data. We offer a super simple service that helps you there.
    - oefrha 7y ago
      I think the problem is that there might not be too much overlap between projects so simple that developers would completely outsource user accounts and data management, and projects handling data so sensitive that it’s preferable to completely lose access when password is forgotten (which is very common) than tolerate the slim chance that data could be leaked through hacking.
DVassallo 7y ago
End-to-end encryption is one of the main features of the product. Since the key is user-controlled, there will always be something that the user must keep and never lose. For this first version, we chose to make that thing the user’s own password. Other end-to-end encrypted apps (such as password managers) have the same requirement. Sometimes the password is resettable, but you have to keep another key. But there’s always something that would lock you out if you lose it.
- jwblackwell 7y ago
  End to end encryption is not a feature most regular users even understand, let alone want.
mattlondon 7y ago
Agreed - love this as a concept, but the fact that users cannot reset their password makes this a non-starter for me.
prophesi 7y ago
Gosh, I would love if more services didn't offer any account recovery, and refused email/password combos found in HaveIBeenPwned. With perhaps a discount code for a password manager below the sign-up form.

Eikon 7y ago

This is a case where usability should trump security in most cases. The final user may even think wanting something like this. Until they ultimately lose their password.

j-berman 7y ago
I personally think (and hope) the ever-growing issues surrounding data privacy and the constant stream of data breaches we hear about will push people to demand solutions like this and embrace the tradeoff that comes with it. Hope we get more people using password managers. Hope we get more people thinking more deeply about how they can protect their data. Time will tell what the people want! :) That's my idealistic way of looking at it. Practically speaking, the burden on developers to adhere to GDPR and other data privacy laws is quite high. You can use this service to store sensitive user data and relax :)
- weego 7y ago
  That'll absolutely not happen in our lifetime if ever. You're projecting your developer centric view onto non-technical users who demand solutions that don't add friction to their lives, if it does it's not solving a problem but just adding a new layer of problems for them.
  - j-berman 7y ago
    Protecting data is solving a problem almost everyone is interested in, including non-technical people. And the existence of password managers disproves your claim regardless. It adds more friction to my life to use a password manager versus an insecure password. We're hitting a very particular tradeoff with this product, one which is largely untapped. We'll see which way the chips fall :)
  - ec109685 7y ago
    So not true. Browser and OS vendors recognize this problem. “Store this key securely and provide it to me” makes sense to implement, so websites can take advantage of all the hardening and security features of the device versus hoping someone doesn’t share a password between two sites.
- tzjmetron 7y ago
  This sounds bad.

j-berman 7y ago

Userbase dev here Yes, this is a thorny issue. We chose to offer a service that keeps user data end-to-end encrypted by default. With that choice comes this tradeoff. And it’s a tradeoff similarly offered by practically every other end-to-end encrypted service I’m aware of. That being said, we have plans to alleviate the weight of this tradeoff, and we’ve already written nearly all of the code. That code is pending a security review and further refinement. The high level summary of it right now is: 1. you as the developer can opt to keep the user’s key stored in plaintext in local storage (via a single parameter passed to our signIn() method) 2. if a user forgets their password, they can get a temporary password emailed to them, then use it to sign back in 3. the user can then change their password normally

paublyrne 7y ago
If your product is SAAS aimed at helping to add authentication to simple apps with low lift, then I think it's a real problem. If I use this product in my product and my customer loses access to her account, then it becomes my problem, and my customer won't want to hear that I can't get their access back.
- j-berman 7y ago
  Agreed it would be a problem for a developer to use Userbase as is and not understand this is a tradeoff. I take it you think it's not clear this is a tradeoff, which is an issue, duly noted :) However, your customers also don't want to hear that you were hacked and all their sensitive data is now in someone else's hands. We offer easy-to-use protection from that increasingly common scenario. You (and your customers) also presumably don't want you to break privacy law regulations storing data. We offer a super simple service that helps you there.
  - oefrha 7y ago
    I think the problem is that there might not be too much overlap between projects so simple that developers would completely outsource user accounts and data management, and projects handling data so sensitive that it’s preferable to completely lose access when password is forgotten (which is very common) than tolerate the slim chance that data could be leaked through hacking.

DVassallo 7y ago

End-to-end encryption is one of the main features of the product. Since the key is user-controlled, there will always be something that the user must keep and never lose. For this first version, we chose to make that thing the user’s own password. Other end-to-end encrypted apps (such as password managers) have the same requirement. Sometimes the password is resettable, but you have to keep another key. But there’s always something that would lock you out if you lose it.

jwblackwell 7y ago
End to end encryption is not a feature most regular users even understand, let alone want.

mattlondon 7y ago

Agreed - love this as a concept, but the fact that users cannot reset their password makes this a non-starter for me.

prophesi 7y ago

Gosh, I would love if more services didn't offer any account recovery, and refused email/password combos found in HaveIBeenPwned. With perhaps a discount code for a password manager below the sign-up form.