XSF Discussion - 2022-10-24

could we standardize a common private pep namespace for keeping account secrets?

I mean, account recovery is the most painful thing

What are you proposing to store in there?

Everything that would be useful to cop^Widentify a user

Well that's basically it

The traditional solution is to have a secondary contact method (usually email, possibly phone number)

Yeah. That's also what I would do, an optional secondary contact method

And if there isn't one, too bad

Yes, it should be the user's choice. No recovery contact, no recovery.

Or you know what we could do? Have the user provide some secret arbitrary string for their account, which, upon presentation, proves they are the account owner...

Yeah riseup does that

And that can be automated even

The server could even generate it itself during account creation

The joke was that I was describing passwords 🙂

Heh

And we know all the things we do to protect passwords already. If we have recovery secrets, we'd need to do the same for those unless we want to weaken security. And if the user can't remember the password, how can they remember a (secure) recovery string?

Who manages xmpp.work nowadays? I just realized "free software" (/ foss) wasn't a label there. Is there a way to add it?

pep.: I think guus offered to support