Delight: Highlight the importance of the security passphrase

[daniellekirkwood]

During a user's first session we don't explain the security passphrase to users. If a user does not set it up correctly, or loses this it makes it much harder to log in (impacting D1 and user success!)

At some point during the first session we should take time to educate users and ensure that they're set up for success when they choose to return to Element.

[aaronraimist]

Related: element-hq/element-meta#1886 element-hq/element-meta#1474 element-hq/element-meta#361 #19594

[germain-gg]

I'm not so sure this would impact D1 that much.
The risk with not setting up your security passphrase is that you loose the ability to retrieve your encrypted messages when you create a new session.
This would typically happen much later. And users could totally be deterred from using Matrix/Element ever again when they realise they've lost everything. But I wonder how often people will hit that issue in the first 24 hours of using the product

[daniellekirkwood]

I'm not so sure this would impact D1 that much. The risk with not setting up your security passphrase is that you loose the ability to retrieve your encrypted messages when you create a new session. This would typically happen much later. And users could totally be deterred from using Matrix/Element ever again when they realise they've lost everything. But I wonder how often people will hit that issue in the first 24 hours of using the product

Thinking out loud; If D1 is "returned users in a 24h period" and users are using the Web product they may need to sign in again when they return tomorrow...

In my head it looks like this: User creates account, user validates email, user signs in, user starts DM and sends message, user closes browser tab, user opens element tomorrow, user needs to sign-in, user can't sign in because no security passphrase...

I guess we could find out how common it is to signin vs already be signed in when you return to app.element.io?

[t3chguy]

In my head it looks like this: User creates account, user validates email, user signs in, user starts DM and sends message, user closes browser tab, user opens element tomorrow, user needs to sign-in, user can't sign in because no security passphrase...

If you don't explicitly log out, closing the tab will not require you to sign-in again. Matrix sessions never expire unless manually done so by you on one of your other devices or your server admin. The exception to this is if you are running a browser like Tor which is amnesiac and forgets everything when you close it.

[daniellekirkwood]

Good to know - I have adjusted the Occasion and Priority rating of this issue accordingly

[daniellekirkwood]

Moving to "Next" as it's not prioritised just yet but we marked it as important

[daniellekirkwood]

We should also make the language consistent

[daniellekirkwood]

@pmaier1 & @americanrefugee

Also see this issue that was onboarding feedback...

Feel free to close this if it's a duplicate of things you're already tracking.