If I transfer my FID using recovery, what happens to my farlet? Is it controlled by the new FID private key?

Dad, geek, conversation liquidity provider. @l--o--l | @wdimapp

lemon3

So, Farcaster can use the recovery function to transfer my fid (and my wallet) to a new set of keys that I don't control?

How this works, for anyone who has not studied the details.

How this works, for anyone who has not studied the details.
https://paragraph.com/@purplesubmarine/farcaster-account-recovery

@farcaster dev / dad / books, cooks, ski, code ~ there are many things of which a wise man might wish to be ignorant

generally agree, but how to make them more aware? for instance, this is spelled out in our public doc on the wallet architecture, but it's not something that is easy to explain to a new user

yea I'm actually surprised there isn't a great "recovery as a service" provider (Privy could probably build something here) but it's probably a thankless service in that people don't want to pay for it and it's actually quite hard to do securely, you need to keep the keys both hot and safe and you need to make sure they are only accessed by the intended audience
https://www.notion.so/farcasterhq/Wallet-Architecture-1a56a6c0c101802fa30ef476a8561033

Now that people attach to their FID a couple of thousands of dollars, I think a) they should be aware of it, and b) there should be some encouragement/push for alternative recovery services. 

(And b will probably get a push from a).

if you're FID is configured to be recovered by Farcaster then yes

there used to be an additional time lock mechanism so that even if you used a 3rd party recovery service you could still "block it" if you controlled the custody

the problem with this is users would need to see this action happened onchain and take action, so in practice it's not great

this was removed in favor of the simplicity and UX of instant recoveries given that you could configure this same system in a smart contract anyway

https://github.com/farcasterxyz/protocol/discussions/100

They use Privy, just like every other app with an embedded wallet. If the recovery function is directly from Privy, it's safe, I think. If it has Farcaster involved, it may need another layer of trust.

Basically don't put more than 150m in your farcaster wallet I guess