As a consumer though, I could change my password on a server if it gets stolen. But how would I reset it after my phone was stolen if authentication is all stored client side?
Yes, it certainly mitigates the scale of a potential breach and I like that the reduced scale/potential value makes it a less attractive target to hackers (assuming the server side is also built in a secure way). I havent investigated, but it makes me nervous to think that if my phone is stolen, the thief gets my data too.
Sure, but designing around the inherent riskiness of user behavior/forgetfulness is an important part of security systems. Users want to be protected, not for blame to be shifted to them.
Comments
What happens if your phone gets stolen?
0.0000014286% of the damage that happens when Sony's database gets hacked (assuming equal payload).
As a consumer though, I could change my password on a server if it gets stolen. But how would I reset it after my phone was stolen if authentication is all stored client side?
Then one user's password gets stolen, as opposed to thousands.
Yes, it certainly mitigates the scale of a potential breach and I like that the reduced scale/potential value makes it a less attractive target to hackers (assuming the server side is also built in a secure way). I havent investigated, but it makes me nervous to think that if my phone is stolen, the thief gets my data too.
Use a PIN, and if possible, encrypt your phone. It won't completely mitigate the risk, but it will reduce your surface area.
Then wouldn't that be the user's fault/problem?
Sure, but designing around the inherent riskiness of user behavior/forgetfulness is an important part of security systems. Users want to be protected, not for blame to be shifted to them.