3 ms·

If I have specific keys per service device pairs, how do I go about retiring the keys from a device that has been compromised? What if a service doesn't allow

If I have specific keys per service device pairs, how do I go about retiring the keys from a device that has been compromised? What if a service doesn't allow you to register multiple keys per account? If I'm using an OS controlled keychain, what is the best way to handle it's contents in a OS agnostic way that is easy to back up just like dotfiles work? Are there any resources that go into how to handle keys safely in a lot more specific detail?

m_mueller 13y ago
The problem about compromised devices is first to recognize it, right? There is basically no way to know for the server, other than a lock request sent by a user using a different, already authenticated device (if that's not available, the user first needs to authenticate a device using the e-mail/sms/rsa token process mentioned above). When such a request is sent, the public key of the compromised device stored on the server gets deauthorized. In fact, a per-device public keys makes the whole process much easier, obviously, since specific devices can be locked out, rather than locking a whole user account. About OS keychains: I'd imagine there are some multi-platform wrapper libraries to deal with this, but I've never specifically looked for such a thing, sorry. If there isn't already such a library in place I'll probably write one in javascript in 2014, since we're going to need it for the PaaS we're currently developing.