session-desktop icon indicating copy to clipboard operation
session-desktop copied to clipboard

Remove ability to display recovery phrase after Session id creation.

Open ianmacd opened this issue 2 years ago • 4 comments

It's fundamentally insecure to allow the recovery phrase to be retrieved with a few mouse clicks at any time.

This patch removes the option from Settings, and appropriately modifies the initial account creation dialogue to indicate the importance of noting down the recovery phrase immediately, as it will not be possible to display it again later.

Contributor checklist:

image image

ianmacd avatar Sep 18 '22 14:09 ianmacd

@ianmacd We are working on improving the onboarding in the next few months (+- 2 months). This issue will be dealt with then 😄 Thanks for pointing it out though.

yougotwill avatar Sep 19 '22 00:09 yougotwill

@ianmacd We are working on improving the onboarding in the next few months (+- 2 months). This issue will be dealt with then smile Thanks for pointing it out though.

It's not so much the enrolment itself, though, as it is not allowing the user to leave the process incomplete, which leaves the door ajar for compromise. A properly enrolled user doesn't need to use Session to retrieve his recovery phrase at a later date.

ianmacd avatar Sep 19 '22 07:09 ianmacd

I don't know when it expires, but there is a survey relevant to recovery phrases:

https://www.surveymonkey.com/r/T5DHW7C

Source: https://nitter.net/session_app/status/1571712123830697997#m (2022-09-19)

beantaco avatar Oct 01 '22 06:10 beantaco

Just to provide an update on this, we are actively working a feature similar to this PR right now in our onboarding project. It will offer users the option in the settings menu to make their seed permanently invisible in the Session UI. We consider this preferable to only displaying the user's seed during the onboarding process. This is because any misunderstandings during onboarding, such as a user accidentally dismissing the onboarding modals, would make recovery and linking of future devices impossible.

KeeJef avatar Mar 28 '24 06:03 KeeJef

This has been completed on all platforms as part of the onboarding release (1.13.0) , see below

image

KeeJef avatar Aug 16 '24 03:08 KeeJef