News for hackers. Stuff that matters.

A comment on Show HN: No more 12-word seed phrases. Parent comment

Re:Show HN: No more 12-word seed phrases by jhunter1016 on Wednesday September 11, 2019 @12:36PM (#20942028)
It absolutely does. All we store is an encrypted version of the user's master keychain (the 12-word seed phrase we're trying to eliminate). We can't access that keychain without the user's consent. The user is emailed a copy of this encrypted keychain and can take it with them to any service that supports bip39 seed phrases.

Try getting Google to let you do that ;)

[ Parent | on HN ]
Re:Show HN: No more 12-word seed phrases by mcdee on Wednesday September 11, 2019 @02:03PM (#20942951)
> All we store is an encrypted version of the user's master keychain

Is the seed created and encrypted on the client or the server?

[ Parent | on HN ]
Re:Show HN: No more 12-word seed phrases by jhunter1016 on Wednesday September 11, 2019 @02:21PM (#20943126)
We chose this method because it requires trust of just one entity (the lambda end point we provide) rather than trust of each app that might interact with SimpleID's SDK. If the seed phrase is generated client-side within an app, that developer could hold onto that seed and use it maliciously.

Identities created through SimpleID can be used across multiple apps, so it's important to us that developers are only able to access data specific to their app (i.e. app-specific encryption keys).

[ Parent | on HN ]
Re:Show HN: No more 12-word seed phrases by prabhaav on Wednesday September 11, 2019 @02:13PM (#20943051)
The seed is generated on the lambda, encrypted client side and stored in our database.
[ Parent | on HN ]