How does EOS help users to get back their hacked accounts? Should hacked account continue to be used? [duplicate]

Question

One of the more impressive features of EOS that will help my mother be a part of the blockchain movement is that if she loses her private key, she can get it back with the help of a trusted 3rd party. Am I right? If so, how?

Is it only the private keys she can get back or can she get back the tokens which were stolen from that account as well?

And what must she do next, create a new EOS wallet and move the funds there? Because it doesn't make sense to use the key that was once exposed to the internet, correct?

Please explain like I'm 5 :)

Answer 1

1. The owner permission is set to multi-sig with 3rd party 2nd factor
2. The owner permission can also be configured to be controlled by the eosio.recovery contract
3. The eosio.recovery contract will allow you (or your friends) to change the owner permission if the owner permission has been unused for 30+ days, but first you must wait 7 days during which the owner can cancel.

If you are hacked, then you work with the recovery partner to restore your active permission. If you lose your password then your recovery partner(s) can change your owner with proper delay.

The only time you are out of luck is if you are hacked and lose your key at the same time. In this case the hacker can keep your account active (preventing lost password recovery) and you are unable to co-sign with your recovery partner.

If you use hardware wallets, like Apple's secure enclave with touch-id then this last scenario is significantly less likely unless the hacker gets your fingerprint & phone.

You can combine all of this with paper wallets for the truly paranoid.

Furthermore, the multi-sig with the owner links to your recovery partners active permission. This means that they can also be recovered by someone else. This creates an interconnected web that requires the simultaneous hacking of the full graph to permanently gain control of accounts.