[2.5] Present an error message that disallows the use of Incognito with the BTS wallet

[o5j5vg55bv5hv5j5f8799f9]

This was brought to me by another user trying to create an account:

When creating new account here https://bitshares.org/wallet/#/create-account/password

he got stuck at the three dot animation screen after hitting the button. I replicated it as well immediately and took a screenshot.

tested on: 1) windows7, incognito-chrome 2) ubuntu 14 , chrome

[wmbutler]

I think this write-up explains the problem pretty clearly. Do we have a way to immediately inform users that they cannot use incognito with the BTS wallet? This should be a priority bug IMO.

[wmbutler]

The banner can be much like the one we use to display unsupported browsers, but users should not be able to bypass it.

[btsfav]

strange, recently used incognito to sign-up a test acc on OL, no problems.

[wmbutler]

Incognito won't keep localstorage. Huge problem that I don't believe can be overcome. @svk31 ?

[svk31]

Right, it's the localstorage and database storage that make it not suitable. It still works fine with password model logins and to create new accounts, but nothing is stored for the next time you open the browser.

[wmbutler]

Should I UX this?

[wmbutler]

[btsfav]

it does support incognito though. you can sign-up and login, I do it all the time

[wmbutler]

ok, will you take the full time support job of answering people's questions when they don't understand why it breaks due to non-persistent localstorage?

[btsfav]

first of all, this is neither a bug nor high priority, if you want to start arguing.

seconds, move to account model only on registration would ease a lot of support requests and make this issue obsolete too.

[wmbutler]

Increased bounty to 2.5 hours.

[svk31]

I don't think that original error has anything to do with incognito mode, seems like it's a faucet issue maybe. Without a console log it's hard to say. Account creation works fine in incognito mode if you use the password model like the @btsfav says, and it's quite nice to be able to use it that way.

If you insist on having a message like this I suggest we provide a way to say "OK I understand, let me continue anyway"..

[calvinfroedge]

@svk31 There are other features which do not work in other browsers in incognito mode. Firefox was very buggy.

If all of you agree on a button I can add it.

[svk31]

We only officially support Chrome so you don't have to worry about Firefox. I've just successfully created an account in incognito mode in Chrome so there's nothing to indicate there's an actual issue here.

[btswolf]

incognito mode should stay available, but a warning and backup reminder would be good.

[calvinfroedge]

Updated to include a dismissable warning...

[wmbutler]

We are not giving appropriate credit to how damaging this issue is to users who choose the wallet model. Incognito mode does not work for the wallet model. Steps to reproduce:

• Open Incognito mode browser
• Choose Create New Account
• Choose Use Wallet Model
• Choose Restore Wallet from Backup
• Complete Restore Procedure by importing wallet and entering password
• Quit Chrome
• Open Chrome Incognito Window

At this point, it appears to the user that they never imported an account. They have to repeat the entire process. I think it's irresponsible for us to allow users to use incognito mode. We gain nothing but support problems and scars to the bts reputation by allowing users to continue on this path.

[btswolf]

wallet model should be available for advanced users and not beginners.
#301
Incognito mode is the same "damaging" as clearing your browser cache.
We could add a warning like, "Incognito/privacy mode is not supported with wallet model" during account creation. And we could show a warning if a user runs incognito mode in combination with wallet model.
But I am against to disable or forbid incognito in general.

[wmbutler]

@btswolf why are you against it? I think your logic that wallet mode is only for advanced users is unfounded. To the contrary, I think that the wallet model is a much safer implementation than account mode. Account mode can be hacked with just a username and password. We are giving users a false sense of security by recommending it over wallet mode.

[calvinfroedge]

@btswolf As is now implemented, there is no disabling or forbidding, only a warning

[wmbutler]

Although I'm arguing that it should be disabled because there is no benefit to incognito mode.

[btswolf]

@wmbutler it's always security vs. usability.
I am not against recommending the wallet model but many users fear the tradeoff for security they have to pay when they need to deal with backups, that's why account model is so popular.
The question is how to educate users to use the wallet model appropriately when many of them are not even able to use a proper password manager. Giving them simply the choice between wallet or account model results only in many support requests where users asking what they should choose.
For newbies I'd recommend the account model but the GUI could also remind the user every day to learn about the wallet model and upgrade to gain higher security.

Incognito mode is great for troubleshooting and many people are using it for everyday browsing, "believing" it is more secure then non-icognito. Instead of disabling it the GUI could WARN if you try to import or create a wallet model.

[wmbutler]

You didn't state a single benefit of incognito. Believing something is not the same as being true. I would suggest that in order to satisfy all of our users (wallet mode and account mode), that we disallow the use of incognito mode. There is no downside to this strategy because both wallet modes work properly. @calvinfroedge @svk31, I'm hoping you understand my reasoning here.

Imagine the frustration a wallet user faces if they set up a new account and immediately lose it.

[wmbutler]

Instead of disabling it the GUI could WARN if you try to import or create a wallet model.

Why would you allow a user to perform an operation that will, with certainty, disallow them access? Ths line of reasoning makes zero sense to me. We should not even present the wallet model if a user is using incognito.

[btsfav]

incognito allows for secure and traceless logout.

[btswolf]

he got stuck at the three dot animation screen after hitting the button. I replicated it as well immediately and took a screenshot.

I've seen this in the non-incognito mode as well, so incognito may not be the problem.

You didn't state a single benefit of incognito.

Troubleshooting without the need to clear real browser cache is a huge benefit for me.

[wmbutler]

Let's approach this a different way. If Incognito is detected, redirect the user to this page only. This way, we do not present a breakable path to the user.

[wmbutler]

I've tried creating both wallet and account models in incognito mode. When I attempt to login with either of those accounts from a new incognito window, neither work. This is utterly ridiculous that we support incognito mode under any circumstance. Watch:

[wmbutler]

The BTS wallet simply does not work in incognito mode. If you disagree, please post screencast evidence to the contrary. NOTE: you must close the incognito browser and open a new one to test thoroughly.

[wmbutler]

Change the text on the modal and remove the button.

"This Bitshares Wallet relies on Local Storage which is not persistent with Incognito. Please launch a regular browsing session."

Remove the "I understand" button.

Pro users, can of course bypass this by hitting a registration endpoint manually.

[btswolf]

I did the same test and I agree that incognito is not working flawlessly and it should be not supported like other browsers are not supported too. But actually I only had to click the login button twice to get past the password error so it cannot be completely screwed. However all I want and other users too is the ability to use it, even if buggy and unsupported. A big warning that "it is not supported and by using it you risk the total loss of your account and funds" should do it.

[wmbutler]

@svk31 observed the same and is looking into a bug fix. If he is able to fix it, I'll recommend only allowing account creation but disallow wallet creation.

[btsfav]

screencast of a full use in incog: https://vid.me/hlRlA