Greetings,
really love Passbolt, it’s a great software.
However there’s one thing which bothers me a bit and I am trying to find out if you can turn it off or not.
When you want to recover your account, on a new computer for example, you need your private key AND you need to have access to your email, to click the recovery link.
Because I cannot import my private key if I don’t have access to the link sent via email during the recovery process, right? Now what if I lose access to my email account, my private key is essentially useless, isn’t it?
Following scenario:
Someone steals your laptop, but you have a copy of your private key!
However, you don’t have access to your email, because the password is stored in Passbolt (and you don’t know it by heart)
To gain access you have to click a link sent to your email by Passbolt, during the recovery process.
But you can’t click that link, because you don’t know the password of your email account (since it’s stored in Passbolt).
Question: Is there a way to recover your account, only having access to the private key? No Email.
This is a good question. Even without emails sent, the admin has access to links generated and found in the db. The link could be manually pasted into the browser.
Thank you friend, I understand what you are suggesting.
Unforunately I am aiming for a very specific scenario, where one has no access to anything without passbolt. Now since I am the administrator, I could not log into the server and check the database without getting access to the passbolt account first.
Oh wait, I get it. The problem is, you can’t have passbolt without at first not having passbolt. In your scenario you are putting access to the server into a state of dependency on a passbolt account.
Hmm. I would personally hesitate to do so.
However, in a creative case the server could call out on regular basis to another server to receive a package that it can process to return a link. In this setup there is no “inbound” traffic except the web traffic. A reverse API so to speak. This is outside of the scope of the current app.
I know it is not the wisest option to depend on a private key and passphrase to retain access to any credentials within my infrastructure.
What I want to achieve with this though, is a protection against an extreme edge case: be able to regain access to all of my passwords stored inside of Passbolt, using only the private key.
This way I can rely on my private key which is securely stored on a encrypted device, to regain power of everything basically.
Let’s say I am in another country and only have the private key and no access to anything else besides a new browser where I haven’t initialized Passbolt yet and have no access to any email account.
Thanks for your creative suggestion though, tha sounds like an idea worth exploring…