1

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email address. Unless there is a way to opt out of this (which I have never seen), that leaves my account at their site vulnerable to email take over or interception.

Instead of allowing the security conscious to opt out of password reset emails altogether, I've pondered the idea of letting people optionally register a PGP public key, and then using that key to encrypt the reset token that gets emailed.

I think it would theoretically be better to have them send a signed password reset request, rather than decrypt a token, because this seems more in the spirit of having separate keys for separate purposes. But encrypting the token would conceptually be a very simple change to one part of the existing code:

if (defined key) encrypt(token,key); 
email_send(token);

Whereas a signature based system would be an entirely new system, so would have more opportunities to mess it up.

I have never seen anything like public key encrypted resets done. This lets the account owner calibrate for themselves exactly how much effort they want to go through to secure their private key. Is there precedent for this? Is there some reason it wouldn't work?

(This is for my curiosity, I don't plan to implement such a system.)

2 Answers 2

1

Keep it simple. Sending signed mails with given, parseable format makes things rather complicated. If a user opts for encrypted mail, send him (all, including all other) mail encrypted, including password resets.

Selbstauskunft.net (German language only), a service for sending requests to companies request information they store about you based on privacy law, lets you do exactly this: you can select an OpenPGP key (which they list based on a keyserver query), and if you do so, they will also encrypt the password reset mail.

Regarding OpenPGP mail interfaces, only Hetzner, a German hosting company offering an e-mail API using OpenPGP signed message for domain registration.

1
  • Thank you for the examples. I hadn't considered non-reset emails, just because I didn't think about there being other kinds of email sent. But I think it would be nice to be configurable. If my private key is kept offline, for example, I wouldn't want to retrieve it for ordinary emails but only for ones that would allow the account to be taken over.
    – jjanes
    Nov 3, 2014 at 17:15
-1

I think https://bugzilla.mozilla.org/ is already doing that for password reset mails if we upload our PGP Public Key to our account.

For password reset emails, they encrypt the message and the token using our Public Key and send to our email ID.

1
  • This is more of a comment than an answer. I've also edited out the self-promotion, which isn't appropriate for Stack Exchange site answers. Leave it in your profile.
    – Xander
    May 20, 2015 at 2:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .