desmos-labs / mooncake

The first decentralized social app based on Desmos
MIT License
46 stars 14 forks source link

Mnemonic should be removed from the device when app delete #12

Closed kwunyeung closed 4 years ago

kwunyeung commented 4 years ago

Currently the user mnemonic is securely stored using flutter_secure_storage which stores the value inside the device secured storage which is Keychain on iOS. The default behaviour of iOS is to not remove any data in Keychain even when the app is uninstalled. The mnemonic is securely stored this way as only the app with the specific provisional profile can access the specific key/value in the storage. However, users will feel uncomfortable if the value always stay on the device even if the app is removed and feel strange if the app sign in automatically when the app is reinstalled.

It is better to force the user sign out when the user remove the app or force the user sign in again when the app is reinstalled. The solution to this UX is to remove all the key/value in the secured storage on every app install. This can be achieved by detecting the First Run on iOS.

Here is a reference to the implementation in Flutter.

https://stackoverflow.com/questions/57933021/flutter-how-do-i-delete-fluttersecurestorage-items-during-install-uninstall

RiccardoM commented 4 years ago

Thanks for the heads up @kwunyeung and providing a reference implementation :pray: I've fixed this problem inside 626978378bf63853417c0fa40e1bafa664d09658

You can find the implementation here: https://github.com/desmos-labs/mooncake/commit/626978378bf63853417c0fa40e1bafa664d09658#diff-3cf0daa5234314b3eb9fd67f58ffab89R97