diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 1a1f9fc..ae7f8fc 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -598,10 +598,15 @@ browser writes an identity bundle to a node and holds the recovery key, a **seco copy** is written beside it sealed under `recovery_key` (`bundle_enc_recovery`, additive on the wire), in the same format and bound to the same account and node. The desktop application writes one when the recovery key is entered on the -Profile page, for an account with browser access. `R` is a pass-through: shown once -on screen at registration and mailed with the verification code only if the person -ticks the box for it (unticked by default), never written to any database, never -logged. +Profile page, for an account with browser access. **`R` never reaches the hub.** +It is shown once on screen at registration, and the person may mail it to +themselves from their own mail application (a `mailto:` link, which the desktop +and Android shells hand to the system), so it never passes through the hub's +mail, is never written to any database and is never logged. The hub refuses a +registration that carries one: an older client that still offers to have it +e-mailed is told so rather than left to say it was sent. A mailbox holding `R` +is, with the reset code that reaches the same mailbox, enough to recover the +account's identities — that is the person's choice to make, and the link says so. The reset endpoints are built to leak nothing. `POST /v1/users/password/reset-request` requires **the username and the email on file as a pair**, checked against a blind |