With simple clicks possible to guess the phrase

[cemoo121]

Issue description

Briefly describe the issue.

Wallet version

0.3.1

Which version of wallet are you using?

Firefly

System specification

What is your operating system?

Win10

Is it a repeatable issue?

Y

Steps To reproduce the issue

see the video

i don't think anyone should be allowed to continue without writing down the phrase with simple clicks.
There are enough people who are too lazy but when they lose their iota the crying is big.
In my opinion, you should turn off the suggestion of the phrase words, so people are forced to write down these words because otherwise you do not get on and they can not blame you.

firefly_mini_bug.mp4

[rafaeldjpbrochado]

This is a feature, not a bug. I don't think I agree with the suggestion that this should be removed. I can understand where you're coming from, but I personally liked this feature as I thought it was a good way of tutorializing the mnemonic seed (especially for non-DLT-savvy users).

You could just as easily argue that for maximum security, users shouldn't be given those 3 options to choose from, and they should instead be forced to manually write their entire mnemonic seed. However, UX is just as important as security. This is the onboarding phase, so there is some responsibility here in having to teach the user while offering them as little friction as possible for getting into the app. In my opinion, the first input of mnemonic seed should have guard-rails, as currently implemented. Especially given that storing the seed is optional. Users may not want to save it, and instead just backup their Stronghold snapshot. It's up to the user to decide.

[cemoo121]

It was just a hint, you are welcome to delete my post. rafaeldjpbrochado ***@***.***> schrieb am Sa., 27. März 2021, 07:06:

…

This is a feature, not a bug. I don't think I agree with the suggestion that this should be removed. I can understand where you're coming from, but I personally liked this feature as I thought it was a good way of tutorializing the mnemonic seed (especially for non-DLT-savvy users). You could just as easily argue that for maximum security, users shouldn't be given those 3 options to choose from, and they should instead be forced to manually write their entire mnemonic seed. However, UX is just as important as security. This is the onboarding phase, so there is some responsibility here in having to teach the user while offering them as little friction as possible for getting into the app. In my opinion, the first input of mnemonic seed should have guard-rails, as currently implemented. Especially given that storing the seed is optional. Users may not want to save it, and instead just backup their Stronghold snapshot. It's up to the user to decide. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#758 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATNNHDLW6PDOUTYJOQJ4ASLTFVYURANCNFSM4Z4JILAQ> .

[rafaeldjpbrochado]

@cemoo121 Oh I'm just a Firefly community member, not one of the developers. Let's wait and see what other community members think!

[cemoo121]

Ok

i think i agree with you on some points but it is dangerous especially for lazy beginners but that should be up to the developers to decide. You are welcome to delete the note

[cyclux]

Maybe a compromise would be to reset the procedure after x times of wrong choice(s). Actually that's what I assumed would happen if I choose wrong.

[rafaeldjpbrochado]

@cyclux Hm yeah that's not a bad idea, assuming the threshold is high. Maybe 5 or so failed attempts. Then it goes back to square 1.

@cemoo121 Lazy users are not the exception, but the rule. By adding friction you're not gonna cure their laziness, you're just gonna prevent them from using the app. If some users intentionally skip saving their mnemonic seed by doing the thing you showcased in the video, it's not dangerous. The seed is optional. Some users actually prefer not to store their mnemonic seed at all and instead just rely on Stronghold snapshots.

[BrianStinerGithub]

We could increase the security hugely by increasing the number of options per selection without making it any harder for the user with a written down phrase to get back in.
Maybe 3^24 isn't secure enough. 4^24 isn't that hard to change and its way more secure.
That said, maybe adding contacts is more important to focus on, so spending is easier.
Its not a pleasant experience to copy paste.
I've seen before a way to check copy paste memory for the most recent payment code then automatically paste it and grey the box out.