I've been looking into JWT tokens (claim that this device is authorized to do something). If there is a breach on server side, you simply replace public and private keys. Each user can also have a different public key.
Registration on User side:
1. Enter email
2. Welcome email with token
3. Save token (password manger, mobile phone, print it...)
4. Use app
If someone steals your token, you simply request new token and old gets immediately invalidated.
It's like Mozilla Persona, but there is no middle man.
Comments
I've been looking into JWT tokens (claim that this device is authorized to do something). If there is a breach on server side, you simply replace public and private keys. Each user can also have a different public key.
Registration on User side:
1. Enter email
2. Welcome email with token
3. Save token (password manger, mobile phone, print it...)
4. Use app
If someone steals your token, you simply request new token and old gets immediately invalidated.
It's like Mozilla Persona, but there is no middle man.