Hacker News Reader

Comment by sp332 | Hacker News Reader

How do you deal with key management? Specifically, what do you do if someone doesn't remember their passphrase or loses their private key entirely?

View on HN

You start over! Everything is gone, so what else can you do?! No joking, this is a serious issue.

I know that's how PGP usually works, unless you have a backup somewhere. It's the #1 reason I don't promote using it very much. I was hoping this team had thought about improving that part of the user experience.

"Key escrow". The FBI/NSA were pushing for it way back in the mid 90s.

I'm not saying you have to give the key to anyone you don't trust. Just set up a system where it's easy to recover the key with the help of someone you do trust.

Also, I might have the wrong term. I was thinking of dividing the key into multiple messages, say in a 2-of-3 system or something. Not just handing control of your account to a 3rd party.

I would say that if you lose your key you lose your data, as it should be.

People only want security, not the reality and hence responsibility that comes with it.

There are different kinds of security. Confidentiality and availability aren't exact opposites, and I don't think you have to compromise so hard on one to get the other. A good key escrow system or at least encouraging people to keep their passphrase in their wallets or something would go a long way to reducing the users' risk.

Reply on news.ycombinator.com