Restoring accounts on a new device: is an encrypted archive wanted? (#1004)

[lucamzanon]

Today the list of accounts lives only in the browser. On a new device you add every mailbox again by hand.

#1004 tries to fix this with an archive that the browser encrypts with a password chosen by the user (AES-256-GCM, PBKDF2). The server only stores the ciphertext. Mailbox passwords are optional, and without them you only get the list of accounts back. You called it high risk, and with the new guide it should have started here, so here it is.

I looked at doing it as a plugin, but it isn't possible with the current API: a plugin can't create or restore logins, and only reaches the account on screen.

Questions before I redo it:

1. Do you want this in core at all?
2. If yes, would you take it in steps? For example:
   1. only the list of accounts, no passwords
   2. then the passwords
   3. then the prompt on a new device
3. Anything in the security model you'd want done differently?

I'll close #1004 or keep it as a reference, whichever you prefer.

[rathlinus]

If it is secure i am fine with it as a gated feature

[lucamzanon]

thanks. then I'll redo #1004 as a series, off by default behind an admin setting: first only the list of accounts (no passwords), then the passwords, then the prompt on a new device. I'll close #1004 once the first one is up