Double confirmation of account password

tzarebczan commented

2019-06-01 20:53:16 +02:00

(Migrated from github.com)

Copy link

The Issue

Probably a good idea to ask for double confirmation like we do in the desktop app. This may add more friction, but it's also better than typing it incorrectly and losing the credits.

@kauffj edit attack: also make entering your password opt-in, rather than default

System Configuration

Device:
Android version:

Anything Else

Screenshots

Internal Use

Acceptance Criteria

Definition of Done

Tested against acceptance criteria
Tested against the assumptions of the user story
The project builds without errors
Unit tests are written and passing
Tests on devices/browsers listed in the issue have passed
QA performed & issues resolved
Refactoring completed
Any configuration or build changes documented
Documentation updated
Peer Code Review performed

## The Issue Probably a good idea to ask for double confirmation like we do in the desktop app. This may add more friction, but it's also better than typing it incorrectly and losing the credits. @kauffj edit attack: also make entering your password opt-in, rather than default ## System Configuration - Device: - Android version: ## Anything Else  ## Screenshots  ## Internal Use ### Acceptance Criteria 1. 2. 3. ### Definition of Done - [ ] Tested against acceptance criteria - [ ] Tested against the assumptions of the user story - [ ] The project builds without errors - [ ] Unit tests are written and passing - [ ] Tests on devices/browsers listed in the issue have passed - [ ] QA performed & issues resolved - [ ] Refactoring completed - [ ] Any configuration or build changes documented - [ ] Documentation updated - [ ] Peer Code Review performed

akinwale commented

2019-06-03 14:05:04 +02:00

(Migrated from github.com)

Copy link

@tzarebczan What do you think about making the password field visible by default instead and then the user can choose to hide it afterwards? Would like to keep the first run / enroll process as simple as possible by just using one field per screen.

tzarebczan commented

2019-06-09 00:00:44 +02:00

(Migrated from github.com)

Copy link

If we are allowing blank passwords, I think we should go with double. It's even normal on many other apps and sites, let alone crypto ones. Already had one person forget their password..think this will make them a bit more aware when typing. If we had 2fa for recovery, I'd say 1 is enough , but otherwise there's no way for us to get back the pw.