<story><title>Show HN: Userbase – Add user accounts and persistence to your static site</title><url>https://userbase.com/</url></story><parent_chain><item><author>paublyrne</author><text>From the FAQ:&lt;p&gt;&lt;i&gt;What happens if a user forgets the password?
Users should always keep a copy of their password in a safe place, such as a password manager. Since the encryption key needs to be decrypted by the user&amp;#x27;s password, it is not possible to recover an account if the password gets lost.&lt;/i&gt;&lt;p&gt;I don&amp;#x27;t believe this is acceptable for a user authentication service. Password reset functionality must be present for this to be production ready.</text></item></parent_chain><comment><author>DVassallo</author><text>End-to-end encryption is one of the main features of the product. Since the key is user-controlled, there will always be something that the user must keep and never lose. For this first version, we chose to make that thing the user’s own password.&lt;p&gt;Other end-to-end encrypted apps (such as password managers) have the same requirement. Sometimes the password is resettable, but you have to keep another key.  But there’s always something that  would lock you out if you lose it.</text></comment>
<story><title>Show HN: Userbase – Add user accounts and persistence to your static site</title><url>https://userbase.com/</url></story><parent_chain><item><author>paublyrne</author><text>From the FAQ:&lt;p&gt;&lt;i&gt;What happens if a user forgets the password?
Users should always keep a copy of their password in a safe place, such as a password manager. Since the encryption key needs to be decrypted by the user&amp;#x27;s password, it is not possible to recover an account if the password gets lost.&lt;/i&gt;&lt;p&gt;I don&amp;#x27;t believe this is acceptable for a user authentication service. Password reset functionality must be present for this to be production ready.</text></item></parent_chain><comment><author>j-berman</author><text>Userbase dev here&lt;p&gt;Yes, this is a thorny issue.&lt;p&gt;We chose to offer a service that keeps user data end-to-end encrypted by default. With that choice comes this tradeoff. And it’s a tradeoff similarly offered by practically every other end-to-end encrypted service I’m aware of.&lt;p&gt;That being said, we have plans to alleviate the weight of this tradeoff, and we’ve already written nearly all of the code. That code is pending a security review and further refinement.&lt;p&gt;The high level summary of it right now is:
1. you as the developer can opt to keep the user’s key stored in plaintext in local storage (via a single parameter passed to our signIn() method)
2. if a user forgets their password, they can get a temporary password emailed to them, then use it to sign back in
3. the user can then change their password normally</text></comment>