3 ms·
How are the keys currently managed? That's something I'm not clear on. Any user-managed key is a lost cause outside use cases where it's obvious to all parties
by Kye 3y ago
How are the keys currently managed? That's something I'm not clear on. Any user-managed key is a lost cause outside use cases where it's obvious to all parties why it's important and everyone has the patience to manage it. Secret management always seems to end up centralized, adding potentially adversarial parties to the chain of trust.
I at least know I never had to set up any kind of recovery key for my Bluesky account, so I assume this is handled on bsky.social even though my handle is @ my domain.
- vidarh 3y agoAs far as I can tell their intent (and I don't know if this is followed through) is for the clients to hold both keys and copies of your other data, without really making much of a point of it to users. I think that's a good idea as a worst case fallback, but a bad idea to rely on, but in either case it ought to be made clearer to users.