{"action":"created","issue":{"url":"https://api.github.com/repos/blockstack/blockstack-browser/issues/1749","repository_url":"https://api.github.com/repos/blockstack/blockstack-browser","labels_url":"https://api.github.com/repos/blockstack/blockstack-browser/issues/1749/labels{/name}","comments_url":"https://api.github.com/repos/blockstack/blockstack-browser/issues/1749/comments","events_url":"https://api.github.com/repos/blockstack/blockstack-browser/issues/1749/events","html_url":"https://github.com/blockstack/blockstack-browser/issues/1749","id":390638502,"node_id":"MDU6SXNzdWUzOTA2Mzg1MDI=","number":1749,"title":"Adventures in re-authentication","user":{"login":"markmhx","id":28991,"node_id":"MDQ6VXNlcjI4OTkx","avatar_url":"https://avatars2.githubusercontent.com/u/28991?v=4","gravatar_id":"","url":"https://api.github.com/users/markmhx","html_url":"https://github.com/markmhx","followers_url":"https://api.github.com/users/markmhx/followers","following_url":"https://api.github.com/users/markmhx/following{/other_user}","gists_url":"https://api.github.com/users/markmhx/gists{/gist_id}","starred_url":"https://api.github.com/users/markmhx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markmhx/subscriptions","organizations_url":"https://api.github.com/users/markmhx/orgs","repos_url":"https://api.github.com/users/markmhx/repos","events_url":"https://api.github.com/users/markmhx/events{/privacy}","received_events_url":"https://api.github.com/users/markmhx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-12-13T11:36:11Z","updated_at":"2018-12-13T14:22:25Z","closed_at":null,"author_association":"NONE","body":"This issue details the broad friction I encounter whenever trying to re-authenticate my account. I'm curious if others encounter the same and what they think we can or should do about it. Perhaps this issue is already represented in part or full by other issues, I'm not sure. But I have to imagine the below UX problems are affecting a ton of our users and crippling their ability to trust in their Blockstack IDs, let alone understand them.\r\n\r\nStep-by-step, here's how I usually flow through the process:\r\n\r\nFirst, I see the \"Enter Secret Recovery Key or Magic Recovery Code\" modal:\r\n\r\n<img width=\"482\" alt=\"screen shot 2018-12-13 at 12 07 19\" src=\"https://user-images.githubusercontent.com/28991/49934807-a71a3c80-fecf-11e8-9abb-fd8025299bb6.png\">\r\n\r\nAnd my first thought is \"Bleh, I can't remember which one I've actually saved into 1Password – why do we have two of these again??\".\r\n\r\nBut my second thought is, \"It's okay, I should be able to grab either of these from 1Password, copy and paste it into here, hit sign in and be done with it. I *guess* it's good we have two options if they both serve the same purpose\".\r\n\r\nSo I open up 1Password:\r\n\r\n<img width=\"472\" alt=\"screen shot 2018-12-13 at 12 09 50\" src=\"https://user-images.githubusercontent.com/28991/49934940-01b39880-fed0-11e8-8f36-69e5c859c13b.png\">\r\n\r\nAnd I think \"Great, they're both there! I might as well just grab the first one\" while spotting \"password\" out of the corner of my eye and feeling a bit disturbed that I have a *third* password-like thing that I feel responsible for (*bleh*).\r\n\r\nSo I copy and paste the secret recovery key into the modal and hit submit, upon which I hit this modal:\r\n\r\n<img width=\"479\" alt=\"screen shot 2018-12-13 at 12 11 18\" src=\"https://user-images.githubusercontent.com/28991/49935023-358ebe00-fed0-11e8-99c8-397d15a7b297.png\">\r\n\r\nAnd here, I unfailingly think \"W.T.F. is this about? *Create* a password? Why now? Why at all? I already have (a useless) one!\".\r\n\r\nA month ago, I was still wondering if I had to go \"back\" since maybe I actually took a wrong turn somewhere and started through the \"create account\" flow by mistake. But I've been through this enough to know now that it's not the case. Blockstack wants me to continually remake my password for some unknown and annoying reason.\r\n\r\nSo, I do it, since I want to use the app! But I do it by just grabbing the same password I have in 1Password for Blockstack, since I might as well. Copy, paste, past, submit and I see this screen:\r\n\r\n<img width=\"476\" alt=\"screen shot 2018-12-13 at 12 13 40\" src=\"https://user-images.githubusercontent.com/28991/49935153-8a323900-fed0-11e8-9314-320be39c3793.png\">\r\n\r\n\"For. The. Love. Of. God. What. Is. This. Doing.\" Again, I would have wondered before if I'm accidentally creating a new account, but now I know \"better\". So I diligently enter my email again and submit:\r\n\r\n<img width=\"505\" alt=\"screen shot 2018-12-13 at 12 14 36\" src=\"https://user-images.githubusercontent.com/28991/49935180-ab932500-fed0-11e8-9169-c0c7f4677e48.png\">\r\n\r\n\"Ok, this is better...but 'restore'? Did I screw up my account at some point and now it needs to be rebuilt or something? Is that why I was asked for a new password and email and this is taking so long to process? Oh well...I hope my data is still in here and didn't get lost...\".\r\n\r\n<img width=\"481\" alt=\"screen shot 2018-12-13 at 12 15 48\" src=\"https://user-images.githubusercontent.com/28991/49935249-d8dfd300-fed0-11e8-8222-33d064155185.png\">\r\n\r\n\"Hurray! It seems I'm in, and my account has been fixed, if it was indeed broken.\"\r\n\r\n\"That's weird you want me to view and save my secret recovery key though...I entered that earlier in the flow after all. I better look at it and compare it to the one in 1Password to make sure it hasn't changed, though this is a bit of a hassle\".\r\n\r\n<img width=\"477\" alt=\"screen shot 2018-12-13 at 12 17 03\" src=\"https://user-images.githubusercontent.com/28991/49935309-03319080-fed1-11e8-82a9-12efb125b2d5.png\">\r\n\r\n\"Oh hell, just (re)show it to me already\"\r\n\r\n<img width=\"487\" alt=\"screen shot 2018-12-13 at 12 17 54\" src=\"https://user-images.githubusercontent.com/28991/49935384-2f4d1180-fed1-11e8-90f7-29f508c45879.png\">\r\n\r\n\"Thank you! But it's the *same as before*....why am I here then!\". I hit continue, hoping it'll just take me to the app since \"Back\" feels like I might get lost and never make my way there.\r\n\r\n<img width=\"476\" alt=\"screen shot 2018-12-13 at 12 19 30\" src=\"https://user-images.githubusercontent.com/28991/49935461-5efc1980-fed1-11e8-863f-3de06507b5ec.png\">\r\n\r\nI start questioning whether I want to even use the app...but sunk cost has a hold of me, and I'm an employee of Blockstack PBC. So I go back to 1Password, pick out the words and select them\r\n\r\n<img width=\"492\" alt=\"screen shot 2018-12-13 at 12 20 59\" src=\"https://user-images.githubusercontent.com/28991/49935548-95d22f80-fed1-11e8-8077-df47c557f323.png\">\r\n\r\n\"I....I already saw this...am I in the twilight zone?\" I hit the button...and I'm finally done.\r\n\r\n----\r\n\r\nNow, I don't always choose the secret recovery key at the start of the funnel but instead grab the \"magic recovery code\", because frankly, I forget the difference. Because I have PBC knowledge, I know one is basically the \"seed\" but I have a 50/50 chance of knowing which one that is until I copy and paste from 1Password (and I presume that the seed one is better to use or faster, but that's just a suspicion).\r\n\r\n<img width=\"471\" alt=\"screen shot 2018-12-13 at 12 23 57\" src=\"https://user-images.githubusercontent.com/28991/49935682-fbbeb700-fed1-11e8-8ab7-987617a8cf1d.png\">\r\n\r\nSo let's say I copy and paste the magic recovery code into the first prompt and submit, I then see this:\r\n\r\n<img width=\"464\" alt=\"screen shot 2018-12-13 at 12 24 36\" src=\"https://user-images.githubusercontent.com/28991/49935712-14c76800-fed2-11e8-87a7-bf210e67816e.png\">\r\n\r\n\"Why why why? I just gave you a password-like thing. Why do we even have two?\". I go back into 1Password and copy and paste the password, though, and submit:\r\n\r\n<img width=\"489\" alt=\"screen shot 2018-12-13 at 12 25 29\" src=\"https://user-images.githubusercontent.com/28991/49935751-345e9080-fed2-11e8-9cb0-7e82cf3f34a7.png\">\r\n\r\n\"What. That can't be right. I literally just set this new password 5 minutes ago after going through authentication with my secret recovery key to write up this rant.\" So I copy and paste it again.\r\n\r\n<img width=\"484\" alt=\"screen shot 2018-12-13 at 12 26 35\" src=\"https://user-images.githubusercontent.com/28991/49935795-5821d680-fed2-11e8-87b0-a63c178bc333.png\">\r\n\r\n\"Ok what, that can't make any sense. The password *has* to be right, doesn't it? But it does say 'Incorrect password or *invalid recovery code*' so maybe I actually saved my recovery code incorrectly in 1Password in the first place?\"\r\n\r\nI remember (fortunately) that this was emailed to me last summer so I search \"magic recovery code\" in my Gmail account, and voilà:\r\n\r\n<img width=\"1074\" alt=\"screen shot 2018-12-13 at 12 29 44\" src=\"https://user-images.githubusercontent.com/28991/49935969-cff00100-fed2-11e8-8fe1-78fac4618bdf.png\">\r\n\r\nI cross-check it with my 1Password value and it appears the same. So I copy and paste it out of 1Password and search for in the page on Gmail *just to be sure it matches exactly* and it does. \"Ok, what's going on here\".\r\n\r\nI go back to looking at the modal and look even closer, noticing it says at the bottom \"The password you entered when you created this Blockstack ID\". \r\n\r\nI start to have self-doubt. \"Have I always entered the same password when previously authenticating with the secret recovery key instead of the magic recovery code? Have I actually inadvertently saved a *new* password to my account that can't actually be used for anything since only the *original* works here? Does that make any sense? Why would a system ask for a new password if it can't be used in this situation?\".\r\n\r\nAnd I retreat with back buttons to the \"Secret Recovery Key\" flow, assuming my magic recovery code and password are basically worthless."},"comment":{"url":"https://api.github.com/repos/blockstack/blockstack-browser/issues/comments/446985396","html_url":"https://github.com/blockstack/blockstack-browser/issues/1749#issuecomment-446985396","issue_url":"https://api.github.com/repos/blockstack/blockstack-browser/issues/1749","id":446985396,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0Njk4NTM5Ng==","user":{"login":"aulneau","id":11803153,"node_id":"MDQ6VXNlcjExODAzMTUz","avatar_url":"https://avatars3.githubusercontent.com/u/11803153?v=4","gravatar_id":"","url":"https://api.github.com/users/aulneau","html_url":"https://github.com/aulneau","followers_url":"https://api.github.com/users/aulneau/followers","following_url":"https://api.github.com/users/aulneau/following{/other_user}","gists_url":"https://api.github.com/users/aulneau/gists{/gist_id}","starred_url":"https://api.github.com/users/aulneau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aulneau/subscriptions","organizations_url":"https://api.github.com/users/aulneau/orgs","repos_url":"https://api.github.com/users/aulneau/repos","events_url":"https://api.github.com/users/aulneau/events{/privacy}","received_events_url":"https://api.github.com/users/aulneau/received_events","type":"User","site_admin":false},"created_at":"2018-12-13T14:22:25Z","updated_at":"2018-12-13T14:22:25Z","author_association":"COLLABORATOR","body":"It's actually not accurate that the 'secret recovery code' was sent to you. we never send that anywhere."}}
{"actor":{"display_login":"aulneau"}}