Status-react: Keycard users should have a "remember me" feature too

[guylouis]

Problem

Standard Status users can chose on their login screen a "remember" me option, that allows them to not enter their password/Pin when they next try to login.

With current implementation keycard users don't have this choice, and must always tap their card and enter their PIN to login.

Desired behaviour

When first login with his keycard, we ask the user if he wants to be remembered. If he choses yes, then he won't be asked to tap his card or enter his PIN at next login. He will need to tap his keycard for any signing of transaction though.

open: do we want a way for the app to forget a user ?

Steps

• design update to ask the user if he wants to remember his 'login'
• implementation

FYI
@hesterbruikman
@dmitryn
@flexsurfer
@andmironov

[dmitryn]

Some notes regarding implementation:

encryption-public-key and whisper-private-key needs to be securely stored to be able to login automatically.

Also, screenshot from Figma https://www.figma.com/file/dEIljL7UPbXgsZUA0Q4qlE5E/Onboarding?node-id=1125%3A187&viewport=2632%2C-1171%2C0.4031412899494171

[guylouis]

@corpetty
this is not implemented yet, however it's on the backlog
can this be done post code freeze or should it be done before ?

cc @rachelhamlin

[corpetty]

this can be done post-freeze as we should have the same model for doing it (same as non-keycard).

[yenda]

The proposal here https://github.com/status-im/status-react/issues/8535#issuecomment-535609803 is directly relevant to this issue, because to avoid having to login with keycard you need to store the chat account on the device and encrypt it with a secret stored in the keystore.

So I see it working that way:

• if the device has no secured enclave, it still works as of now and there is no way to login without keycard, the keycard is basically your secured enclave
• if it has a secure enclave, it works like the regular login described in the proposal, using the sha3 of the seed phrase as the secret to encrypt the db and the keyfile of the chat account (as well as accounts you exported on the mobile to use without keycard). User can then choose between PIN, card + PIN and biometric to authenticate for login and use of local keys, and still always need keycard for wallet accounts stored in keycard.

Additionally, the PUK is generated on status side, so I would suggest that we also use the sha3 of the mnemonic there, because there is no point adding the burden of another secret to save on the user. He will take a picture or ignore it.

This mean you can login with the pin only on keycard account, because if you really think about it or actually try to use keycard on your main account for just a few day, you will understand how silly login with keycard is.

[guylouis]

cc @andmironov @yenda
also, as discussed furing today's weekly, this should go through a design review, to make sure the full experience (no keycard/keycard, biometric/no biometric) is consistent, and user is not lost

[andmironov]

here are the latest designs for it

full flow here https://www.figma.com/file/dEIljL7UPbXgsZUA0Q4qlE5E/Onboarding?node-id=4566%3A12

[andmironov]

New issue for this https://github.com/status-im/status-react/issues/9354