Hacker News Reader

While I am not too familiar with how Stellar/Ripple work, I assume they are sending an un-encrypted version of your Stellar private key, or perhaps the equivalent of a bitcoin master private key [1].

I say un-encrypted based on their claim that the code + username can be used to gain access; typically sites will encrypt the recovery code with your password. Based on this, I conjecture that they decided in favor of usability in the usability-security tradeoff.

[1] https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...

In your settings, you can turn off recovery for this reason. The plan is to move quickly to two-factor.

I'm not worried, I'm the only one with that code and even I can't access my account. What a trainwreck.