If MFA is turned Off, where are the backup shares stored?

[ReclaimD]

Hi,
I wanted to make MFA optional for users but had a couple of questions in scenarios where MFA is OFF/Optional:

1. On App A, MFA is optional and skipped by a user, where is the 2nd and 3rd share stored and retrieved? Does web3auth store it in a custodial way?
2. On App A, MFA is optional. When a user with MFA turned off, turns it on later, How is the key managed in this transition?
3. If App A has MFA mandatory, and App B has MFA Off, and user who earlier used App A, logins to app B on a different device, will app B ask for MFA?

[rinzler99]

Hey Thanks for reaching out to us.

1. On App A if MFA is optional and skipped by user, user will have 2 shares: device and social login. Obviously these shares are self custodied to user and user will require 2/2 shares to access account.
2. If user doesn't skip MFA and sets it up then user can login to account using any 2 out of 3 shares i.e. 2/3 shares.
3. For App A and App B case, we have two scenarios:
   a. For both apps you have used same verifiers: In this scenario, for app A MFA is mandatory and user sets up MFA and later he tries to login to App B then user will not be asked to set up MFA again instead will be asked to provide any 2 factors from device, recovery phrase, social login, etc.
   b. For both apps you have used different verifiers: In this scenario, App A and App B will generate different accounts for same user as verifiers are different. So, for App A user will need to set up MFA as it is mandatory. And for App B user won't need to set up MFA as it is off.

[rinzler99]

Point 1: True, if user is using 2/2 factors(social login and device) and looses any one of these two factors they loose their account. Clearing localstorage won't lose the account but loosing the device or changing the browser will do.

Point 2: Yes web3auth manage transition from 2 shares to n number of shares without affecting existing shares while keys remain same!

[ReclaimD]

Hey @rinzler99, while the original question was answered, I am having trouble replicating it.
Pre-MFA, you should not be able to retrieve the wallet if you change browsers because local share is lost. But when I tried the torus wallet on app.tor.us, I am getting the same wallet across different browsers, I haven't turned on MFA. I can share the email and pub key privately if needed.

[rinzler99]

Ohh ok, I got mistaken before you setup MFA you can login to multiple browsers on multiple devices because Pre-MFA doesn't store device/browser into openlogin so it looks 1/1 Pre-MFA to secure your accout you need to setup MFA.
Thanks!

[ReclaimD]

Thanks for clarifying @rinzler99, so its 1/1 share pre-MFA, and once MFA is turned on, the same key gets split into 3 shares?

[ppoliani]

@rinzler99 what is AppA and AppB be are web dApp and a mobile app? Ideally, we would want users to seamlessly restore their account across different devices.

From my understanding, when we create a new account with MFA on AppA (browser), there will be 2/3 setup. One share is stored in the local storage, the other is emailed to the user and finally the third is retrieved from the torus nodes.

Imagine now that the same user wants to use a native mobile app. So he would get the one share from the torus odes via social login and he can provide the second share which he can find from their email.

Here is where I'm very confused. We now have two shares which are the same. But we have two devices. Does the share stored on the browser still valid? And id so does it mean that we now have a 2/4 threshold setup to recreate the private key?