search

cryptomator / hub

Cryptomator Hub helps you manage vaults in large teams
GNU Affero General Public License v3.0
36 stars 8 forks source link

Reset User Account #208

Closed overheadhunter closed 8 months ago

overheadhunter commented 12 months ago

As a user, who lost access to all devices as well as the Setup Code, I want to reset my user account to gain access again.

Resetting will re-roll the user's key pair. I.e. while the user can remain a vault member, keys need to be re-shared ("Update Permissions" button).

Furthermore, we need to decide, whether the user needs to re-validate his devices, as in the meantime a malicious admin could have sneaked in fake devices which we must not allow to receive a copy of the user's new key.

### Tasks
- [x] discuss necessity of removing the user's devices
overheadhunter commented 11 months ago

I would argue that re-adding devices isn't much pain and is certainly not unexpected, if a user knowingly resets her account. Thus we should remove them as well, mitigating attacks that are based on sneaking in unauthentic devices.