keybase / keybase/keybase-issues

Logging in on a new device: UX issues with passphrase prompts

Open
#2,195 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

I'm setting up Keybase on a new computer after a few months away from the service. In the intervening time, y'all have deployed your new key model (congratulations!)

I'm having trouble understanding what's being prompted for here. Here's my whole login session:

```
% ○ keybase login

How would you like to sign this install of Keybase?

(1) Use an existing device
(2) Use a paper key
(3) Use my Keybase passphrase
Choose a signing option: 3
Your keybase username or email address: cbowns
Please enter the Keybase passphrase for cbowns (12+ characters):
Please enter keybase passphrase to unlock the secret key for:
PGP key keybase.io/cbowns 79A0E576289DA6A5

Reason: sign new device:
▶ ERROR Failed to unlock key; bad passphrase
Please enter keybase passphrase to unlock the secret key for:
PGP key keybase.io/cbowns 79A0E576289DA6A5

Reason: sign new device:
```

When this prompt appeared:

```
Please enter the Keybase passphrase for cbowns (12+ characters):
```

I entered the passphrase I have for keybase.io, and it successfully auth'd. (I verified this by entering an incorrect password for cbowns@keybase.io, and it errored out.)

The prompt after it is what confuses me:

```
Please enter keybase passphrase to unlock the secret key for:
PGP key keybase.io/cbowns 79A0E576289DA6A5

Reason: sign new device:
```

"Please enter keybase passphrase" suggests to me that my keybase.io passphrase is what's again being asked for. However, that passphrase fails (as seen above in "ERROR Failed to unlock key").

Is this prompt actually asking for my keybase login, or for my PGP passphrase?

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the reported `keybase login` flow on a new device and compare the two passphrase prompts shown in the session. Trace the signing and PGP-key unlock steps far enough to establish which credential each prompt requests; done means the prompt wording clearly distinguishes them and the behavior is verified against this login sequence.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.