Hacker News Reader

You can email the user a one-time token for setting a new password.

You should never store the users password.

When you email a token, you're back to square 1 and will need 2 factor auth.

In addition the reset password is not possible when the data is encrypted on the client side. This is how TrueCrypt works - if you forget the password, all your data is lost.

Data isn't encrypted on the client side only the "password" is.

Data encryption on the client side is one of the 5 features. See https://github.com/rahvee/CBcrypt and the "Tech Details Video".

"Users are able to login to servers, and encrypt all their data, without ever exposing their password or encryption keys to the server."

"And if the user's data on the compromised server is encrypted using the user's keypair, then even the users' data is still protected."

Reply on news.ycombinator.com