privacyspreadsheet.com icon indicating copy to clipboard operation
privacyspreadsheet.com copied to clipboard

Track "Account migration"

Open maltfield opened this issue 1 year ago • 1 comments

This is a request to add a new row (called Device migration) to the spreadsheet that tracks whether or not a user can migrate their account between devices by exporting a backup of their account data (including private keys and message history) and then import that backup into a new install on a distinct device.

Problem

For a cryptographic communication system, it's critical that users authenticate their contacts to ensure that they're sending messages to the correct person (not someone pretending to be them).

If, however, a user changes devices and doesn't migrate their private keys -- then prior authentication checks are lost.

Solution

To fix this issue, many apps (eg Threema) have the ability for users to make a backup of their account's private keys -- so that users can migrate their account from an old device to a new device, without all their contacts loosing their out-of-band authentication verification.

Some other apps (eg Signal) store private keys in the TPM and intentionally make it impossible to make a backup of an account's private keys -- so that users cannot migrate their accounts from an old device to a new device.

A new row (called Account migration) should display if an app allows users to export a backup of their account's private keys (and, optionally, their message history) so that they can migrate their account between devices without breaking prior out-of-band authentication checks by their contacts.

maltfield avatar Feb 04 '24 21:02 maltfield