As a User I can perform a Account Recovery provided I'm still able to access my account on my mobile device

Feature requests
1

Q1. What is the problem that you are trying to solve?
I want to prevent, the scenario that a user perfom a account recovery (lost passphrase or/and private key, and the admins are unreachable (or take time to process the recovery) or is just absent.

Q2 - Who is impacted?
Everyone

Q3 - Why is it important and/or urgent?

  • I project to manage multiple instance of passbolt cause of several company’s group, so it can be time consuming and complex to manage account recovery
  • I’m in apprenticeship so i have absence’s period, so it can speed up the process for the+ user.

Q4 - What is your proposed solution? (optional)
The account recovery involve the mobile app and we face two case scenario :

  • User’s phone has biomectric identification enabled and he can still acces to his account through the mobil app even if he’s forgot his passphrase or lost by any reason his private key.
  • User’s phone don’t have biometric identification and user can still access to his account through the mobil app with his passphrase even if he lost by any reason his private key.

The first solution is to export private key through de mobile app. (cover just the lost of private key if no biometric identification)
The second is copy and reverse the mekanism use to link a mobile app to an account through the web. In the web client when the User initialize an account recovery, he is offer to scan a QR with the mobile app (where the user is authentified with passphrase or biometric id) that “link” the web client with the account authentified in the mobile app, and then define a new passphrase and download a new recovery kit. The best exemple i can name, is when you try to connect to Discord in web browser you can scan a QR code with an authentified account on discord mobile app and connect.

The Admin can choose to always enable this feature or enable it to preempt his absence.

Q5. Community support
People can vote for this idea to show traction:

  • :ok_woman: Must have: this is critical for me to have this
  • :raising_hand_woman: Should have: this is important for me to have this
  • :tipping_hand_woman: Could have: this could be nice to have
  • :no_good_woman: Won’t have: we should not schedule this (explain why)

0 voters

2

Hello,

We already started working on this, namely the mobile to mobile part:

Then once we have the mobile to mobile we’ll be able to do mobile to web in a second part.

2 Likes