Hacker News Reader

>The tricky bits are (1) explaining to the users that they can't reset their password

So that's interesting, because as I understand it ProntonMail does allow users to reset their password using a recovery email, although the feature can be disabled in the settings.

View on HN

If a user resets their single password or encryption password, they lose access to their previous e-mail. This is because what essentially happens is that a new PGP keypair is generated and the Secret Key is encrypted with the new password. Since we do not have their old, lost, password we cannot access their secret key to decrypt the e-mails (and subsequently re-encrypt them with the new Public Key).

An alternative is to generate a bunch of recovery keys, encrypt the PGP key pair with each of them, and store the result (but not the recovery keys). If you go for the 1 password solution this should be a no brainer, but still way too complicated for the utterly non-technical user (so most of them).

Reply on news.ycombinator.com