WordPress / two-factor

Two-Factor Authentication for WordPress.
https://wordpress.org/plugins/two-factor/
GNU General Public License v2.0
724 stars 151 forks source link

Use simpler/less-technical wording and UI. #521

Closed dd32 closed 1 year ago

dd32 commented 1 year ago

This draft PR contains a lot of textual changes, which overall simplifies the language (See #516) but also the UI. This was mostly an experiment for myself in context of potential simplification for non-technical users.

Before After
Profile page Screenshot 2023-02-14 at 4 26 19 pm Screenshot 2023-02-14 at 4 26 07 pm
Login with a singular alternative Screenshot 2023-02-14 at 4 27 13 pm Screenshot 2023-02-14 at 4 37 41 pm
Login with multiple alternatives Screenshot 2023-02-14 at 4 26 31 pm
Screenshot 2023-02-14 at 4 26 38 pm
Screenshot 2023-02-14 at 4 41 02 pm
I don't love the stacked buttons, but i equally don't love the hidden list.
The buttons are a bit much, especially with multiple of them, so I also experimented with keeping the existing grey text: Single Multiple
Screenshot 2023-02-14 at 4 36 11 pm Screenshot 2023-02-14 at 4 42 26 pm

It's obvious why the expander list was chosen when multiple other methods are enabled, but it doesn't provide a better interface, only a slightly cleaner one. I also now wish I hadn't kept with the capitals in the sentences, but I've made the screenshots.

jeffpaul commented 1 year ago

I concur that the buttons are a bit much and that the grey links "looks better". A slight tweak to capitalize Code in Emailed Code to match the case of the other two links would make things look "more similar" on those.

jeffpaul commented 1 year ago

An alternative to the experimental designs here could be to mimic how GitHub handles the alternate methods. Specifically meaning in a second rounded square section with context updated to our methods:

Having problems?

  • [Try using an Emailed Code]()
  • [Try using a Backup Code]()
  • [Try using a Dummy Method]()

GitHub example screenshot: Screenshot 2023-02-15 at 2 47 50 PM

ironprogrammer commented 1 year ago

@dd32, the simplified text on the profile page example reads much better! 👍🏻

I like how @jeffpaul's GitHub example more clearly delineates the alternates. It's a stronger implication to "try these instead." Using TOTP seems better than burning a backup code. For this reason, it may not be a bad thing for the language to hint that the alternates are for when they're having trouble with TOTP 🤷🏻.

paulschreiber commented 1 year ago

The term "U2F" is no longer used and the technology has not been supported in browsers for over a year. Just "Security Key" is fine. See also #427.

dd32 commented 1 year ago

The term "U2F" is no longer used

Just noting that this PR doesn't touch anything related to U2F, the U2F references in the screenshots are simply due to #427 not being finalised yet.

dd32 commented 1 year ago

Rebased and re-merged this a few times.. Using the discussion above, I took a step back and came up with a simpler direction here.

Before After
Profile page Screenshot 2023-02-14 at 4 26 19 pm Screenshot 2023-04-13 at 5 03 25 pm
Login with a singular alternative Screenshot 2023-02-14 at 4 27 13 pm Screenshot 2023-04-13 at 4 56 43 pm
Login with multiple alternatives Screenshot 2023-02-14 at 4 26 31 pm
Screenshot 2023-02-14 at 4 26 38 pm
Screenshot 2023-04-13 at 4 55 57 pm
ironprogrammer commented 1 year ago

@dd32 I like how these screens have evolved. Definitely more clear and consistent (with itself and with other 2FA flows I'm familiar with). Looks great!

jeffpaul commented 1 year ago

I concur, this looks great and I don't see any reason to continue iterating. Would be fine by me to merge this in and we can iterate later with any community/user feedback.