Re:Don’t Get Clever with Login Forms
by mises on Friday February 15, 2019 @01:35PM
(#19173448)
My security self hates this idea, because a single point of failure is not a good design. How would the key be revoked if lost? Replaced? This seems to necessitate a CA-type infrastructure (like TLS certs). Not something I'm comfortable trusting any corporation or government with.
[ Parent
| on HN ]
Re:Don’t Get Clever with Login Forms
by AnIdiotOnTheNet on Friday February 15, 2019 @03:17PM
(#19174323)
If the account is that important to your life, then there are probably other identifying information associated with it, credit card numbers, addresses, etc. Do what you do today when identities are stolen: contact the company, prove you are who you say you are, and the'll let you assign a new key to your profile.
Otherwise, who cares? Gen a new key and get on with life.