We've revamped the UX for unlocking the user keyring with your sudo password to be significantly less disruptive to your workflow. We've also added the option to skip entering your password entirely on trusted browsers and devices.
Background
Phase is end-to-end encrypted, which means every user has a unique set of encryption keys. This 'User keyring' is itself encrypted and secured with your sudo password.
When you log in to Phase, sensitive data such as Secrets need to be decrypted with your keys, but first your User keyring needs to be unlocked with your sudo password.
You would have seen this "Unlock user keyring" popup on various screens in the Phase Console previously. We made a decision in the early development of the Console to only request this unlock as and when required, so that users would not have to be bothered by it on screens where there was no sensitive data to be decrypted, such as "Settings" or "Home" pages.
However, we realized that this resulted in the popup displaying at unpredictable moments in the workflow when navigating around the Console. Users didn't realize when they were crossing a 'trip-wire' in the navigation by opening a route that required some data to be descrypted, and the unexpected interruption in the form of the "Unlock user keyring" popup was annoying and unpleasent.
UX Improvements
To improve the experience for users and keep the mechanics of user keyring management as 'under-the-hood' as possible, we've made a number of changes to this workflow.
Firstly the keyring dialog is now displayed immediately on logging in. This should make the interruption to user workflow more predictiable and less intrusive. This also ensures that the keyring is unlocked on any route / component, and eliminates the need for ad-hoc sudo password fields, such as as when creating an App.
More context
The keyring dialog has been restyled to provide more context for the currently signed-in user and organisation, including their email and what role they have. This is particularly helpful for users who may be a member of multiple organisations.
Support for trusted devices
A "Trust this device" option has been added to the keyring dialog. Using this option stores the base64 encoded sudo password to browser local storage and allows the keyring to be unlocked without manual password entry. You can use this option on personal trusted devices to bypass the manual keyring unlock process entirely.
A "Device" section has been added to Settings, to see whether or not the current browser is a "Trusted" device' and provides a dialog to remove the locally stored password and revoke the trusted status of the device.
Updated account recovery
The "New device" flow has been reworked into a "Recovery" process, to allow resetting the sudo password by using the account recovery phrase.
The updates are live on Phase Cloud. Self-hosted users should upgrade to Phase Console v2.12.0