I am currently investigating the architecture of the secure, but user friendly service, which combines storing of sensitive private data together with simple authorization procedure.
The approach is perfectly described in the answer on this question. However it assumes that user enters a password during authorization, which it used to generate a derived key (or keys). In this case, the login/password derived slow hash is checked on the server and in case of success the server-stored individual salt transferred back to client which generates password/salt derived key to decrypt the private data protection key.
Please advice what to use instead of password as the client-specific piece of key, when users authenticate through external 0auth providers like google, facebook, etc.?
A saw this question on the same topic, but, unfortunately, there were no suitable answers. I believe, it is possible to generate some kind of key on client side, but have no idea, how to securely transfer this key to another client device. Maybe it could be good idea to do it via special server, not connected to the main one?