search

Nitrokey / nitrokey-app

Nitrokey's Application (Win, Linux, Mac)
https://www.nitrokey.com/
287 stars 55 forks source link

Activate features of '--admin' flag via checkbox in App #419

Closed alex-nitrokey closed 2 years ago

alex-nitrokey commented 5 years ago

It should be possible to activate the features nowadays activated by --admin flag via the App GUI as well. Otherwise, people need to know how to use the cli. As the function "Factory reset" is a valid function for users, this would help them to debug their device without scary command line.

jans23 commented 5 years ago

Why is factory reset useful for ordinary use cases?

szszszsz commented 5 years ago

I think Alex was referring to cases, where users wants the factory defaults on the device after some phase of experimentation with the device [1].

[1] https://support.nitrokey.com/t/is-my-nitrokey-a-brick-now/1802/6

alex-nitrokey commented 5 years ago

I think Alex was referring to cases, where users wants the factory defaults on the device after some phase of experimentation with the device [1].

Yes, I got once more a user request and realized that it would make sense.

Actually, I would even suggest to enable factory-reset in terms of the GnuPG feature, where no admin pin is needed at all. Currently we have 6 option for factory-reset and the App (option 1) only allows it when admin PIN is provided.

It would be way more simple, if we could refer to the App, if someone blocked the card. Some more warnings what the option actually does may be a good idea in this case. (sorry for expanding the scope a bit by this comment)

jans23 commented 5 years ago

The "--admin" mode has more implications than just the factory-reset command, but I don't remember the details. All implications should be first described before deciding on a solution.

szszszsz commented 5 years ago

@jans23 Leaving the --admin mode aside, what do you think about the PIN-less factory reset?

jans23 commented 5 years ago

I think a checkbox in the GUI to enable the --admin mode would be good. Only in the admin mode the PIN-less factory reset should be possible. That should require the user to enter a text string as a confirmation, such as "Enter RESET to irreversibly reset the Nitrokey device".

alex-nitrokey commented 4 years ago

Only in the admin mode the PIN-less factory reset should be possible.

I do not think so. A user can only reset the device via command line tools if the admin PIN is not known anymore and there is no reason for this precation imho. The purpose of a factory reset is to be able to, well, reset the device without the need of anything.

That should require the user to enter a text string as a confirmation, such as "Enter RESET to irreversibly reset the Nitrokey device".

This is a good idea!

Please let us include an option to easily factory-reset within the App without any cli usage. The current situation is unnecessary difficult for general users and causes problem every now and then. If this replaces the --admin or not is not important for me.

szszszsz commented 2 years ago

Recently I have changed the behavior to have it always visible (without adding an additional checkbox):

In case you do not agree with this solution let me know, and reopen this ticket.