privacyspreadsheet.com
privacyspreadsheet.com copied to clipboard
Track "Account migration"
This is a request to add a new row (called Device migration
) to the spreadsheet that tracks whether or not a user can migrate their account between devices by exporting a backup of their account data (including private keys and message history) and then import that backup into a new install on a distinct device.
Problem
For a cryptographic communication system, it's critical that users authenticate their contacts to ensure that they're sending messages to the correct person (not someone pretending to be them).
If, however, a user changes devices and doesn't migrate their private keys -- then prior authentication checks are lost.
Solution
To fix this issue, many apps (eg Threema) have the ability for users to make a backup of their account's private keys -- so that users can migrate their account from an old device to a new device, without all their contacts loosing their out-of-band authentication verification.
Some other apps (eg Signal) store private keys in the TPM and intentionally make it impossible to make a backup of an account's private keys -- so that users cannot migrate their accounts from an old device to a new device.
A new row (called Account migration
) should display if an app allows users to export a backup of their account's private keys (and, optionally, their message history) so that they can migrate their account between devices without breaking prior out-of-band authentication checks by their contacts.