Yes. This is tradeoff of privacy vs recoverability. The best security means I am completely responsible for my own private keys (or passwords). But if I lose them, no one can reset my password for me.
Ultimately, though, I think we are heading toward separating the ownership of the identity and the backup of the identity. I am ok with owning and backing up my own identity. But maybe my dad feels more comfortable with some 3rd party having a backup for him. In that case he can use someone else to be a trusted backup for him.
Right now, if I want to login to Facebook, then Facebook both serves as my identity owner and my identity backup (e.g. "forgot your password?"). I might be ok with Facebook being a backup provider, but I don't want them to be my identity owner.
I'm not sure I understand the distinction between identity owner and identity backup provider. Possession of an unencrypted private key is ownership, in my understanding. To wit, FB might be under some contractual constraint on using that data, but what if they broke that agreement? Would I be able to prove that it wasn't me using my private key? This opens up a "detection" and "enforcement" can of worms.
I think the assumption is that a backup solution is very very strongly encrypted and decrypted on the client side
Re:Bitshares Login
by logic_geek on Tuesday December 23, 2014 @04:09PM
(#8790235)
Someone posted this on the bitshares forum: https://bitsharestalk.org/index.php?topic=12119.msg165957#ms...
This might be a solution to the problem of the potential to loose your private key.
Re:Bitshares Login
by jerrycabbage on Tuesday December 23, 2014 @06:20PM
(#8790775)
You can create a brain key and have the private key based off that. It is supported by Bitshares but requires advanced CLI usage.
This sounds amazing and useful to me, but even if it all works perfectly, I do have one serious concern: if you forget the passphrase to your private key, your online identity is owned by nobody. That is a very scary prospect!
(Also, from a usability/understandability perspective, I think there might be a better, if less secure alternative to the blockchain, something like an encrypted twitter that transacting parties "listen to" for the duration of their transaction.)
(Something I've been thinking about is an ultra-secure private key backup protocol/device to address this concern. So far, the best I can come up with is an (instant) photograph of a screen showing a textual representation of the key.)