In my model I use two different keys, one for authentication and the other for the encryption / decryption of the data that the user saves, each derived from the master password with a KDF function.
How can I safely manage the password recovery for the user if I have no trace of the master password on my database?
What do you think about https://mega.nz mode? In a nutshell:
- When registering, it makes you download a file containing a key (I think your password or encryption / decryption key is encrypted with this random key and stored in their database).
- In case of loss of the access password, it asks you to upload that file containing the key to reset the password.
Is it a good option? It can be done better?