<div dir="ltr">I think the security questions are a great idea!<br><div><br>It might also be worth investigating SMS recovery like LastPass is doing (with locally saved one time password):<br><a href="https://helpdesk.lastpass.com/account-recovery/">https://helpdesk.lastpass.com/account-recovery/</a><br><br></div><div>You get a sense of the possible limitations of this here but who know...<br><a href="https://lastpass.com/support.php?cmd=showfaq&id=375">https://lastpass.com/support.php?cmd=showfaq&id=375</a><br></div><div><div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div></div><div>--<br>Alex Davis <span>// Mountain View</span></div><div>Product Manager // FxA & Sync<br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Tue, Aug 23, 2016 at 5:00 AM, <span dir="ltr"><<a href="mailto:dev-fxacct-request@mozilla.org" target="_blank">dev-fxacct-request@mozilla.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send Dev-fxacct mailing list submissions to<br>
<a href="mailto:dev-fxacct@mozilla.org">dev-fxacct@mozilla.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" rel="noreferrer" target="_blank">https://mail.mozilla.org/<wbr>listinfo/dev-fxacct</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:dev-fxacct-request@mozilla.org">dev-fxacct-request@mozilla.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:dev-fxacct-owner@mozilla.org">dev-fxacct-owner@mozilla.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Dev-fxacct digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Improving password reset (Sean McArthur)<br>
2. Re: Improving password reset (Julien Vehent)<br>
3. Re: Improving password reset (Richard Newman)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Tue, 23 Aug 2016 01:03:46 +0000<br>
From: Sean McArthur <<a href="mailto:smcarthur@mozilla.com">smcarthur@mozilla.com</a>><br>
To: Julien Vehent <<a href="mailto:jvehent@mozilla.com">jvehent@mozilla.com</a>>, Ryan Kelly<br>
<<a href="mailto:rfkelly@mozilla.com">rfkelly@mozilla.com</a>><br>
Cc: <a href="mailto:fmarier@mozilla.com">fmarier@mozilla.com</a>, Ryan Feeley <<a href="mailto:rfeeley@mozilla.com">rfeeley@mozilla.com</a>>, Richard<br>
Newman <<a href="mailto:rnewman@mozilla.com">rnewman@mozilla.com</a>>, dev-fxacct <<a href="mailto:dev-fxacct@mozilla.org">dev-fxacct@mozilla.org</a>>,<br>
Tanvi Vyas <<a href="mailto:tanvi@mozilla.com">tanvi@mozilla.com</a>>, sync-dev <<a href="mailto:sync-dev@mozilla.org">sync-dev@mozilla.org</a>><br>
Subject: Re: Improving password reset<br>
Message-ID:<br>
<<a href="mailto:CAHrH6bMtL_TkEx-hbmUY2CHOcNxj9jR%2BgbhBcHiTPQEo_yx7bg@mail.gmail.com">CAHrH6bMtL_TkEx-<wbr>hbmUY2CHOcNxj9jR+gbhBcHiTPQEo_<wbr>yx7bg@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
I thought we all assumed 'security questions' are just security<br>
vulnerabilities, and just fill them in with `crypto.randomBytes(64)`.<br>
<br>
On Mon, Aug 22, 2016 at 5:59 PM Julien Vehent <<a href="mailto:jvehent@mozilla.com">jvehent@mozilla.com</a>> wrote:<br>
<br>
> On Tue 23.Aug'16 at 10:48:28 +1000, Ryan Kelly wrote:<br>
> > On 23/08/2016 10:43, Richard Newman wrote:<br>
> > > Under the hood there would be a bunch of shamir's secret sharing<br>
> and key<br>
> > > wrapping palaver to actually make things go.<br>
> > ><br>
> > > You mean like wrapping the user's kB with their own kA (prove ownership<br>
> > > of your account) plus your friend's kB (prove non-resetness of their<br>
> > > account)? Yeah, that's a dance, but it could work :)<br>
> ><br>
> > Right, something like that. Alternately, wrap kB with an escrow<br>
> > recovery key kR, shamir split the secret kR, and encrypt the different<br>
> > parts of it in different ways - one part with the user's kA, one part o<br>
> > with the buddy's kB, one part with answers to security questions, etc.<br>
> ><br>
> > But at that point I may be wandering into "fun crypto games" territory<br>
> > rather than "solve a user problem" territory, which does happen to me<br>
> > sometimes :-P<br>
><br>
> Just to be a downer here (apologies in advance).<br>
><br>
> I think that works great in theory. In practice we would end up with<br>
> a bunch of users who listed their ex-spouse who left with the dog and<br>
> the microwave 2 years ago and can't be reached out. I can already see<br>
> the bugs coming into triage...<br>
><br>
> I like the algorithm Richard described, but as a user, I rarely remember<br>
> any of my security answers. To the point that I write them down in an<br>
> encrypted file. I'd be curious to know how non-tech users handle them.<br>
><br>
> - Julien<br>
> ______________________________<wbr>_________________<br>
> Sync-dev mailing list<br>
> <a href="mailto:Sync-dev@mozilla.org">Sync-dev@mozilla.org</a><br>
> <a href="https://mail.mozilla.org/listinfo/sync-dev" rel="noreferrer" target="_blank">https://mail.mozilla.org/<wbr>listinfo/sync-dev</a><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mail.mozilla.org/pipermail/dev-fxacct/attachments/20160823/267fef23/attachment-0001.html" rel="noreferrer" target="_blank">http://mail.mozilla.org/<wbr>pipermail/dev-fxacct/<wbr>attachments/20160823/267fef23/<wbr>attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Mon, 22 Aug 2016 20:58:42 -0400<br>
From: Julien Vehent <<a href="mailto:jvehent@mozilla.com">jvehent@mozilla.com</a>><br>
To: Ryan Kelly <<a href="mailto:rfkelly@mozilla.com">rfkelly@mozilla.com</a>><br>
Cc: <a href="mailto:fmarier@mozilla.com">fmarier@mozilla.com</a>, Ryan Feeley <<a href="mailto:rfeeley@mozilla.com">rfeeley@mozilla.com</a>>, Richard<br>
Newman <<a href="mailto:rnewman@mozilla.com">rnewman@mozilla.com</a>>, dev-fxacct <<a href="mailto:dev-fxacct@mozilla.org">dev-fxacct@mozilla.org</a>>,<br>
Tanvi Vyas <<a href="mailto:tanvi@mozilla.com">tanvi@mozilla.com</a>>, sync-dev <<a href="mailto:sync-dev@mozilla.org">sync-dev@mozilla.org</a>><br>
Subject: Re: Improving password reset<br>
Message-ID: <<a href="mailto:20160823005840.GA7663@mozilla.com">20160823005840.GA7663@<wbr>mozilla.com</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
On Tue 23.Aug'16 at 10:48:28 +1000, Ryan Kelly wrote:<br>
> On 23/08/2016 10:43, Richard Newman wrote:<br>
> > Under the hood there would be a bunch of shamir's secret sharing and key<br>
> > wrapping palaver to actually make things go.<br>
> ><br>
> > You mean like wrapping the user's kB with their own kA (prove ownership<br>
> > of your account) plus your friend's kB (prove non-resetness of their<br>
> > account)? Yeah, that's a dance, but it could work :)<br>
><br>
> Right, something like that. Alternately, wrap kB with an escrow<br>
> recovery key kR, shamir split the secret kR, and encrypt the different<br>
> parts of it in different ways - one part with the user's kA, one part o<br>
> with the buddy's kB, one part with answers to security questions, etc.<br>
><br>
> But at that point I may be wandering into "fun crypto games" territory<br>
> rather than "solve a user problem" territory, which does happen to me<br>
> sometimes :-P<br>
<br>
Just to be a downer here (apologies in advance).<br>
<br>
I think that works great in theory. In practice we would end up with<br>
a bunch of users who listed their ex-spouse who left with the dog and<br>
the microwave 2 years ago and can't be reached out. I can already see<br>
the bugs coming into triage...<br>
<br>
I like the algorithm Richard described, but as a user, I rarely remember<br>
any of my security answers. To the point that I write them down in an<br>
encrypted file. I'd be curious to know how non-tech users handle them.<br>
<br>
- Julien<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Tue, 23 Aug 2016 01:47:07 +0000 (UTC)<br>
From: Richard Newman <<a href="mailto:rnewman@mozilla.com">rnewman@mozilla.com</a>><br>
To: Julien Vehent <<a href="mailto:jvehent@mozilla.com">jvehent@mozilla.com</a>>, Ryan Kelly<br>
<<a href="mailto:rfkelly@mozilla.com">rfkelly@mozilla.com</a>><br>
Cc: dev-fxacct <<a href="mailto:dev-fxacct@mozilla.org">dev-fxacct@mozilla.org</a>>, <a href="mailto:fmarier@mozilla.com">fmarier@mozilla.com</a>, Tanvi<br>
Vyas <<a href="mailto:tanvi@mozilla.com">tanvi@mozilla.com</a>>, Ryan Feeley <<a href="mailto:rfeeley@mozilla.com">rfeeley@mozilla.com</a>>, sync-dev<br>
<<a href="mailto:sync-dev@mozilla.org">sync-dev@mozilla.org</a>><br>
Subject: Re: Improving password reset<br>
Message-ID:<br>
<<a href="mailto:343D6D50842632D1.9944AC3B-9652-4D82-8642-93F1DE7484A0@mail.outlook.com">343D6D50842632D1.9944AC3B-<wbr>9652-4D82-8642-93F1DE7484A0@<wbr>mail.outlook.com</a>><br>
<br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
My suspicion is that non-tech users do one of these things:<br>
1. Blame themselves if they can't remember the answers. They remember going through the process? gosh darn my bad memory, I'm just not good with computers.2. Get the answers right (at least after trying different capitalization), because they choose a question they know the answer to for each option. Their favorite teacher or pet's name doesn't change. That's the motivation for using memorable questions, despite the obvious weaknesses.3. Write the answers down and put them in the fire safe/Keychain notes/Excel spreadsheet. This is actually a pretty decent security tradeoff, and the process (particularly for FileVault!) strongly reinforces that you can't screw this up. Similarly, it gives you a key to write down and put in a safe place. I could find mine if I really looked for it, I guess.<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://mail.mozilla.org/pipermail/dev-fxacct/attachments/20160823/0004071b/attachment-0001.html" rel="noreferrer" target="_blank">http://mail.mozilla.org/<wbr>pipermail/dev-fxacct/<wbr>attachments/20160823/0004071b/<wbr>attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
______________________________<wbr>_________________<br>
Dev-fxacct mailing list<br>
<a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" rel="noreferrer" target="_blank">https://mail.mozilla.org/<wbr>listinfo/dev-fxacct</a><br>
<br>
<br>
------------------------------<br>
<br>
End of Dev-fxacct Digest, Vol 36, Issue 11<br>
******************************<wbr>************<br>
</blockquote></div><br></div></div></div></div>