4 ms·
I'm not a security expert. What's the advantage of creating the recovery_token at registration time? Why can't the site just store master_public_key, and if the
by adrianmonk 4y ago
I'm not a security expert. What's the advantage of creating the recovery_token at registration time? Why can't the site just store master_public_key, and if the user ever needs to do recovery, then use it to challenge them?
- BoppreH 4y agoJust for privacy, otherwise the public master key acts as a unique personal id. While there'd be no reason to publish this information, the service can still get hacked, sell your data, or just have a parent company looking for accounts in common among their services.