shift as much of the dashboard's functionality into the apps as possible

[chaserene]

the dashboard is a part of using Etesync that is not protected by a password. it's an obvious attack surface (whoever can access the associated email address, they can do everything the dashboard enables (manage payments, get account information, end sessions, delete user data).

using the password for this is a bad idea (it should not be typed into a website), and introducing a second password is bad UX.

how about shifting as much of that functionality into the apps as logically possible?