Passpack uses some kind of two key security: One password and one Packing key.
The password allows user to log in and the packing key decrypts data.
From passpack help:
What if I forget my User ID, Password or Packing Key?
What if I Forget my User ID or Password?
If you confirmed your email address with us, you can use this form to recover your User ID or to reset your Password. You will still need to remember your Packing Key though - we can't recover that for you.
What if I Forget my Packing Key?
Your Packing Key can not be retrieved - we do not know it.
In some cases, you may request a "Packing Key Rollback". This is only possible when you have previously changed your Packing Key and you remember the old one but not the new one. When prompted for your Packing Key, if you insert in incorrect Packing Key, while trying to sign into your account, Passpack will prompt you with a link underneath the Unpack button. Click it and follow the on screen instructions.
Please remember that we can ONLY help you if you confirmed your email address with us. If you did not then there is nothing we can do - we're very sorry.
In this case, is the second option you mentioned. I could live with that, because this is a password storage service and security is a must.
SpiderOak has a system that allows user to change password from a logged computer:
Also in the SpiderOak application, you can reset your password. Open SpiderOak and select the Account menu item. The Account window will open. Select the Edit button next to your password, and there you will be able to change it and set an optional password hint. Changing your password from any computer in your SpiderOak account will change your password for all your computers and the web interface.
I think that you could create a simple mobile app that allows user to change the password if password is forgotten. That app should have a session open, and communicate with server in order to reset the password and modify encryption key.
This app will be used as a last resort when everything else fails. In order to reset the password, a malicious user must have physical access to the device. Maybe you should protect access to the app with a 4 code pin (if user wants to). I'll not make the mobile app download mandatory but I'll inform the user: if you forgot your password AND you don't download the app, there is NOTHING we can do. So you're encouraging user to have an option in case of forgetting the password.
From an usability perspective I think that is better to encourage user to download the app rather than having two passwords. From security perspective I think that two passwords alternative is better.
| Feature | Usability | Security |
| Two passwords | 6/10 | 10/10 |
| Mobile App | 9/10 | 8/10 |
In the end the choice is yours, you should evaluate what is more important to your app and make a choise