dashhive / crowdnode-cli

Earn ~6% Interest on Dash via CrowdNode - CLI for Mac, Linux, and Windows
https://github.com/dashhive/crowdnode-cli
MIT License
4 stars 1 forks source link

doc: language around encryption / passphrase #11

Closed coolaj86 closed 2 years ago

coolaj86 commented 2 years ago

Re: https://github.com/dashhive/crowdnode-cli/issues/9#issuecomment-1175749657 and https://github.com/dashhive/crowdnode-cli/issues/9#issue-1295056152

Would you like to protect your keys with a password [Y/n]?

would anything be lost or inaccurate?

I could go with

Would you like to encrypt your keys with a passphrase? [Y/n]:

It needs to be clear that it's encrypting and it needs to be clear that it's not a password.

Passwords are generally understood as a recoverable gatekeeping measure.

Passphrases are generally understood to an unrecoverable part of encryption.

Encryption is not recoverable.

Veritasium has a video on why, contrary to the "don't make me think" principle, it's actually important to cause people to stop and think when they need to learn information. If everything seems friendly and familiar they'll just pattern match and move on without taking in the new information.

coolaj86 commented 2 years ago

The CLI Usage message is a little scary.

CrowdNode staking is managed with a permanent staking key.

The Dash you stake can NOT be retrieved without this key!

Good.

Honestly, I don't want people who don't understand the importance of keys and the dangers of how encryption works to be using this tool.

I added encryption specifically for you, and for the powers that be who need a little security theatre to sleep better at night.

I don't want people to lose their Dash just because they were feeling adventurous and didn't understand the ramifications of forgetting their passphrase or losing their key.

That said. I'm a programmer, not a copy writer.

Maybe it could be reworded to make the user feel more safe if they follow x, y, z precautions.

I'm happy to workshop this, but I feel like I'm better poised to continue making the code of the wallet tools better to the point that I'm personally very confident in my own ability to manage the keys and mitigate risk in code, rather than to wordsmith the current version. \ (For myself, I use an HD wallet, not the randomly generated keys that this tool provides - I don't trust myself to not lose the money, left to my own fat fingers and ADHD)

Ultimately I believe that it should be something like:

Here's a mnemonic super seed, print it out and store it in your safe. (if you don't do that you're going to lose all your Dash one day and you can't blame it on me - I did my best, and emotionally I just can't handle it)

riongull commented 2 years ago

Fair enough. Leave it as is for now.