0

I have a web app. Users can use it to save people's contact details. These contact details are encrypted to ensure that they are difficult to get at if they're leaked.

The encryption system is also designed so that administrators can't access the data either. The encryption key is based on the user's password.

I'm looking into ways to enable password recovery. The problem here is that a forgotten password, at the moment, also entails a total data loss - since the key is based on the password, if you don't know your password then your key can't be worked out, and your data can't be decrypted. Not ideal.

I have a couple of ways to solve this:

  • Store decryption keys. This is a terrible idea from a security perspective, so I'd really rather not do this if it's at all avoidable.
  • Have two passwords. One to get into the account, one to be used for the encryption key. This is an impact on the users.

There may also be other valid methods that I can't think of. What is the most user-friendly?

Improve this question
3
  • I've asked about the security of this feature on Information Security.
    – ArtOfCode
    Commented Mar 30, 2016 at 20:09
  • 1
    Unfortunately, security almost always comes at the expense of immediate experience. You're looking for the best possible experience within the security constraints.
    – plainclothes
    Commented Mar 31, 2016 at 3:09
  • @plainclothes There's a rule that AviD, a moderator on Sec.SE coined: "security at the expense of usability comes at the expense of security". Hence why I'd like a solution that is reasonable in both aspects.
    – ArtOfCode
    Commented Mar 31, 2016 at 8:58

2 Answers 2

Reset to default
2

You should (almost) never compromise security in the name of user experience. Sure, we always want to deliver the easiest solution to our users, but security is a matter that should always be taken seriously. And that means maybe compromising a little your user experience, but you gotta be cautious.

That being said, I advise you not to store the decryption keys, since this can lead to a huge security flaw in the case where these keys leak. Two passwords are a effective way to circumvent this, but your users probably won't remember both of them, just like they generally don't with bank and credit card passwords and pin codes.

Unfortunately, this is something that can't be solved by thinking in user experience. Our friends at Information Security are the ones apt to answer this part of your question for you. However, I can name a few user-friendly solutions that you can analyze with them:

  • Create one-use passwords and tell your users to save them somewhere safe

    This is how some Google services handle password recovery. After logging in, you may prompt the user with a new password, which your service will re-encrypt using this new key. The downside to this method is the fact that some users won't save these passwords, and will lose all their data (which is not really a bad thing, as I'll explain in the last topic).

  • Send a SMS with a one-use password to the user

    May not be the safest nor the cheapest choice, but it works well, and, currently, there are a number of online services that do this for cheap. This will lead again to prompting the user with a new password, so if this isn't possible for security reasons, it should be avoided.

  • Don't offer password recovery at all

    This is probably the best solution in terms of security. Of course, your users won't be flattered by this fact, but you can, and should, tell your users that this is a feature intended to improve security. You should state the fact that security is a major concern for you/your company, thus led to the decision of not risking their data for the sake of commodity. The point here is making sure your user acknowledge the fact that their data is safe, whatever it happens.

Lastly, something that only you may answer: this level of security is really crucial for your application? My opinion is that every application is supposed to be as secure as possible, even small ones. But this is completely up to you.

Improve this answer
0

Passpack uses some kind of two key security: One password and one Packing key.

The password allows user to log in and the packing key decrypts data.

From passpack help:

What if I forget my User ID, Password or Packing Key?

What if I Forget my User ID or Password?

If you confirmed your email address with us, you can use this form to recover your User ID or to reset your Password. You will still need to remember your Packing Key though - we can't recover that for you.

What if I Forget my Packing Key?

Your Packing Key can not be retrieved - we do not know it. In some cases, you may request a "Packing Key Rollback". This is only possible when you have previously changed your Packing Key and you remember the old one but not the new one. When prompted for your Packing Key, if you insert in incorrect Packing Key, while trying to sign into your account, Passpack will prompt you with a link underneath the Unpack button. Click it and follow the on screen instructions.

Please remember that we can ONLY help you if you confirmed your email address with us. If you did not then there is nothing we can do - we're very sorry.

In this case, is the second option you mentioned. I could live with that, because this is a password storage service and security is a must.

SpiderOak has a system that allows user to change password from a logged computer:

Also in the SpiderOak application, you can reset your password. Open SpiderOak and select the Account menu item. The Account window will open. Select the Edit button next to your password, and there you will be able to change it and set an optional password hint. Changing your password from any computer in your SpiderOak account will change your password for all your computers and the web interface.

I think that you could create a simple mobile app that allows user to change the password if password is forgotten. That app should have a session open, and communicate with server in order to reset the password and modify encryption key.

This app will be used as a last resort when everything else fails. In order to reset the password, a malicious user must have physical access to the device. Maybe you should protect access to the app with a 4 code pin (if user wants to). I'll not make the mobile app download mandatory but I'll inform the user: if you forgot your password AND you don't download the app, there is NOTHING we can do. So you're encouraging user to have an option in case of forgetting the password.

From an usability perspective I think that is better to encourage user to download the app rather than having two passwords. From security perspective I think that two passwords alternative is better.

+---------------+-----------+----------+
|    Feature    | Usability | Security |
+---------------+-----------+----------+
| Two passwords | 6/10      | 10/10    |
| Mobile App    | 9/10      | 8/10     |
+---------------+-----------+----------+

In the end the choice is yours, you should evaluate what is more important to your app and make a choise

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.