4 ms·
Yes. This is tradeoff of privacy vs recoverability. The best security means I am completely responsible for my own private keys (or passwords). But if I lose
by deweller 12y ago
Yes. This is tradeoff of privacy vs recoverability. The best security means I am completely responsible for my own private keys (or passwords). But if I lose them, no one can reset my password for me.
Ultimately, though, I think we are heading toward separating the ownership of the identity and the backup of the identity. I am ok with owning and backing up my own identity. But maybe my dad feels more comfortable with some 3rd party having a backup for him. In that case he can use someone else to be a trusted backup for him.
Right now, if I want to login to Facebook, then Facebook both serves as my identity owner and my identity backup (e.g. "forgot your password?"). I might be ok with Facebook being a backup provider, but I don't want them to be my identity owner.
- javajosh 12y agoI'm not sure I understand the distinction between identity owner and identity backup provider. Possession of an unencrypted private key is ownership, in my understanding. To wit, FB might be under some contractual constraint on using that data, but what if they broke that agreement? Would I be able to prove that it wasn't me using my private key? This opens up a "detection" and "enforcement" can of worms.
- patcon 12y agoI think the assumption is that a backup solution is very very strongly encrypted and decrypted on the client side