To transfer your private key to another browser, you can use a 21 characters long recover key.
How does this affect the security value of the service?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
As I understand it, the user has a sensitive secret (his PGP key) in his browser. The server maintains a "recovery mode" in which a copy of the said secret can be recovered in case the browser becomes unavailable (e.g. the user switched to another kind of browser, or to another device), but subject to a "recovery key". IF I offered a service of that kind, then I would store the secret S encrypted (symmetrically) with a user-specific key K, and that key K would be the "recovery key", known to the user, but not to me.
Thus, one can say that a 21-character recovery key does not necessarily imply a reduction or breach in the security model -- provided that it is used correctly.
Disclosure: Mailvelope developer. The original question speaks of a 21 character recovery key, which is not correct. Mailvelope generates client-side a 26 character long string based on cryptographically random values from window.crypto.getRandomValues(). OpenPGP's Iterated and Salted S2K is then used to derive a key for AES-256.
Encryption and decryption of the recovery packet is only done inside the Mailvelope browser extension, which is statically installed and independent of the hoster's server.
For the symmetric encryption Mailvelope relies on the implementation in OpenPGP.js. The output is compatible to what you get with the
--symmetric option in GPG.
The existence of the "recovery key" is likely to be a fatal flaw in the encryption scheme. While a 21 character password is enough storage for a sufficient amount of entropy, users are unlikely to generate enough entropy to provide adequate security. This has been demonstrated time and time again through password crackers that do offline attacks on users passwords.
The vast majority of users don't understand that an offline attacker can (depending on the implementation of key stretching) guess thousands or potentially millions of guesses per second. An attack like this would need to first gain access to the recovery key, though means such as court order or a security vulnerability.