Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email address. Unless there is a way to opt out of this (which I have never seen), that leaves my account at their site vulnerable to email take over or interception.
Instead of allowing the security conscious to opt out of password reset emails altogether, I've pondered the idea of letting people optionally register a PGP public key, and then using that key to encrypt the reset token that gets emailed.
I think it would theoretically be better to have them send a signed password reset request, rather than decrypt a token, because this seems more in the spirit of having separate keys for separate purposes. But encrypting the token would conceptually be a very simple change to one part of the existing code:
if (defined key) encrypt(token,key);
email_send(token);
Whereas a signature based system would be an entirely new system, so would have more opportunities to mess it up.
I have never seen anything like public key encrypted resets done. This lets the account owner calibrate for themselves exactly how much effort they want to go through to secure their private key. Is there precedent for this? Is there some reason it wouldn't work?
(This is for my curiosity, I don't plan to implement such a system.)
