I'd rather see that the login to keybase.io is the same as provisioning a new device: by using a paper key or scanning a qr code - no typing of the pass phrase anywhere unless it's to reset your account. (For most 2FA users, the token device will not be a U2F one but rather their phone which would have the keybase app installed allowing a ‘re-enter’ instead.) The procedure of resetting the keybase account should therefore not be 2FA protected. In the case that a keybase user cannot ‘re-enter’ their account and legitimately wishes to reset their account, they are not likely to also still have the device that generates 2FA tokens. There is a legitimate use case for resetting an account: it’s a last ditch way of keeping your username if all other methods of ‘re-entering’ are impossible. There’s a distinction between resetting your account (destroying your data), which is what the pass phrase currently allows, and ‘re-entering’ your account using a device key or paper key (keeping your data). ![]() Kill pass phrase once device keys Thank you for taking the time to grok it. Adding 2FA is a step in the wrong direction. What makes keybase.io different from Slack, Github, or Dropbox is that it’s designed that we do not have to trust a centralized server whenever possible. And when keeping the pass phrase for account resets, perhaps the ‘regular use’ of keybase.io can be authenticated by scanning a keybase.io-QR-code with an authenticated keybase device. Instead, when keeping the pass phrase for ‘regular use’, paper keys can help to recover an account. The pass phrase can be used for either, but should not be used for both. ![]() Instead of ‘protecting’ the account reset option with the pass phrase and 2FA, there should be a separation between ‘regular use’ of keybase.io, and the ‘all-other-keys-are-lost-please-reset-my-account use’. So, adding 2FA will make it impossible to use the pass phrase in the only use case for which it may still be appropriate. Requiring a 2FA token would likely prevent a legitimate reset, since the 2FA token is likely generated using one of the lost devices. In that case, the pass phrase is the only way to reset all keys and recover the account. Please consider the case when a keybase user loses access to all keybase devices and their keys. Personally, I’m trying to decide where the-continued-use-of-the-‘pass phrase’-after-signing-up-with-keybase falls on a scale between the achilles heel and the thermal exhaust port.Īdding two factor authentication to protect it does not seem to solve the problem -that a pass phrase that’s encouraged for ‘regular’ keybase.io use also allows for an account to be reset- instead, adding 2FA makes the problem worse.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |