diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/static/keyderive.js')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/static/keyderive.js | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js index bd5282c..bfbb94f 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js @@ -386,7 +386,7 @@ async function resealLegacyIdentity(keys, sessionKey, recoveryKey, { userId, nod * * Returns the raw private keys for immediate use after registration. */ -async function registerUser(username, email, password, recoveryMnemonic, captchaToken) { +async function registerUser(username, email, password, captchaToken) { // No keypair here any more. Identity keys are per node: one is generated the // first time this account joins a given node, encrypted under the passphrase, // and left with that node. So an operator who cracks what sits on their own @@ -397,10 +397,8 @@ async function registerUser(username, email, password, recoveryMnemonic, captcha const authKey = await deriveAuthKey(password, username); const payload = { username, email, auth_key: authKey }; - // The recovery mnemonic, when the user opted to have it e-mailed: the hub - // appends it to the verification e-mail and stores it nowhere - // (docs/MESHBAY_DESIGN.md §3.6). Omitted when they chose to save it themselves. - if (recoveryMnemonic) payload.recovery_key = recoveryMnemonic; + // Never the recovery mnemonic: the hub does not see it (docs/MESHBAY_DESIGN.md + // §3.6), and refuses a register that carries one. // The proof-of-work answer, when the hub asks for one. RegisterPage // (auth-page.js) works it out; this function just forwards it. A hub with // the check turned off gets nothing and does not look. |