5 ms·

I'm an engineer at a platform that makes it easier to build privacy-friendly apps. This means that all apps on our platform have app-specific private keys store

by heynk 6y ago

I'm an engineer at a platform that makes it easier to build privacy-friendly apps. This means that all apps on our platform have app-specific private keys stored on the client side (in localStorage), and they never touch a server. With this change, you're essentially "logged out" after 7 days of inactivity. This is pretty a bad user experience. I honestly am not sure how to mitigate this. MacOS Safari might not be a massive market, but iOS Safari is. Any thoughts about how we should address this change?

oefrha 6y ago
Being logged out after 7 days of inactivity could be a little bit annoying but I can live with that, as long as I can log in again. I could be misinterpreting your comment but are you saying your keys are simply destroyed upon this “log out”? Then I’m not really sure why your platform was considered working in the first place, if it’s tied to a specific browser of a specific device and won’t survive a clearing of storage which any user can do at any time for a variety of reasons?
- heynk 6y ago
  No, it's not tied to a specific device. You can of course log back in, and keys are not "destroyed". We ask users to store a 12-word seed phrase, from which all other keys are derived from.
  - oefrha 6y ago
    Okay, I personally wouldn’t hate logging in to a seldom used app once a week too much.
- pier25 6y ago
  What if you don't have connectivity when localstorage is deleted and can't log in? Eg: in a classroom.
  - oefrha 6y ago
    What if someone accidentally erases everything because that’s what they’re told when something doesn’t work right? Answer: it’s volatile storage in the first place, and a tiny one at that. Heck some browsers can be configured to erase everything when closed (when operating in non-incognito/private mode).
    - pier25 6y ago
      > What if someone accidentally erases everything because that’s what they’re told when something doesn’t work right? The difference is that one situation is controlled by the user and the other is not.

by heynk 6y ago

oefrha 6y ago

Being logged out after 7 days of inactivity could be a little bit annoying but I can live with that, as long as I can log in again. I could be misinterpreting your comment but are you saying your keys are simply destroyed upon this “log out”? Then I’m not really sure why your platform was considered working in the first place, if it’s tied to a specific browser of a specific device and won’t survive a clearing of storage which any user can do at any time for a variety of reasons?

heynk 6y ago
No, it's not tied to a specific device. You can of course log back in, and keys are not "destroyed". We ask users to store a 12-word seed phrase, from which all other keys are derived from.
- oefrha 6y ago
  Okay, I personally wouldn’t hate logging in to a seldom used app once a week too much.
pier25 6y ago
What if you don't have connectivity when localstorage is deleted and can't log in? Eg: in a classroom.
- oefrha 6y ago
  What if someone accidentally erases everything because that’s what they’re told when something doesn’t work right? Answer: it’s volatile storage in the first place, and a tiny one at that. Heck some browsers can be configured to erase everything when closed (when operating in non-incognito/private mode).
  - pier25 6y ago
    > What if someone accidentally erases everything because that’s what they’re told when something doesn’t work right? The difference is that one situation is controlled by the user and the other is not.