Immediate Action to Protect Internet Identity w/ Seed Phrases

[plsak]

You’re right, this discussion started quite a long time ago, my addition:

Internet Identity Lack Of Security

Hi, I wanted to start a topic Enhance security on identity.ic0.app but found this one and as it would be duplicated will just comment here. Motivation: Users are supposed to properly secure their auth devices but at the same time are supposed to use them several times per day to access dApps, which are mutually exclusive requirements. I agree with This will allow owner of the Anchor to secure the passphrase and eventually use it as last resort recovery I shared idea for had/dp type…

Internet Identity Lack Of Security

Also note for the => purpose of hidden is improved protection - even if account is compromised (one of devices stolen) or there is a physical attack (happens for BTC), the attacker won’t be able to request all devices as he/she won’t ever see them - never will be sure that got all, which might discourage a major number of possible thiefs.

I just feel that deliberation about security threat for investors takes too long, also note that it’s scary for possible new investors (some expressed this worry to me).

[Roman]

Thanks for letting me know about @jsull9’s concern @wpb. Wenzel is right, I invite you to read this @jsull9 : Internet Computer Content Validation Bootstrap
Particularly the section « Is a recovery phrase as safe as a recovery FIDO device ? ».

[jsull9]

Thank you! I am still learning to navigate this forum so excuse me if the location/timing is off compared to the original discussion.

I appreciate the help though!

[frederikrothenberger]

Quick update from the II team: the protected recovery phrases feature has been released and deployed to mainnet.

Forum announcement: Protected Recovery Phrases: Released & Available Now!
Internet Identity Upgrade Proposal: Internet Computer Network Status

[jonit]

The new locked recovery phrase is a great addition. It has probably been mentioned but an attacker could just access your account ( find your security key ) and send your ICP into another account, without ever worrying about your seed phrase. Is there a possibility of setting send limits, setting time limits on transfers ( 48 hours before it transfers and can be withdrawn in the meantime ) whitelisting addresses and getting email notifications of attempted transfers ? Sorry for all the asks

[jonit]

Also a check seed phrase option, why? If you have multiple seed phrases, in 5 years time you may not know which is which. I’ve been there. Would be great to know which seed phrase actually is the correct for an account you own.

[plsak]

Hi, I believe that every security restriction is good for investors and innovation in this area is never enough.

What could help for the mentioned worry is to stake your ICP - eventual attacker won’t be able to send your funds away and you’ll be able to simply delete the compromised device.

[Elephantul]

I try it to recover an internet identity in nns app, i have right seed but failed. Is any developer kind to tell me why i cant have acces to my funds, acces that should be provided by seed phrase? Thank you