dcposch / scramble

Secure email for everyone
http://dcposch.github.io/scramble/
226 stars 32 forks source link

Passphrase recovery #86

Open dcposch opened 10 years ago

dcposch commented 10 years ago

A Scramble server cannot provide a standard "password recovery" mechanism. The server itself does not have access to your mail, your passphrase, or your private key.

Currently, if a user forgets their passphrase, all their mail is gone forever. This is unfortunate.

We should add an alternative mechanism. When a user is creating an account, we can generate a token for them that they can write down on paper or store on a thumb drive, and which serves as a backup passphrase. Of course, the server never sees this token.