PRODUCT | Enforce 2FA to Access Account Once the Previous Tab/Session Closed? about one-wallet

[polymorpher]

The wallet's information is viewable without authentication, but transfer operations would require one time passwords from Google Authenticator. Recover operation does not require that, so that may be an issue, but does not seem urgent. At some later stage we can add an optional lockscreen feature so that only the user with the correct authenticator code would be able to view the wallet.

[polymorpher]

I revisited this issue and gave it some thoughts. Right now, the wallets are viewable without any lockscreen or password, but the user would not be able to do anything without the correct code from the authenticator, except "Recover Funds", which does not require a code. First, it would not be a good idea to require password or code for "Recover Funds" since that would defeat the purpose of that feature - it was meant to be used when the user loses the means of authentication, i.e. the authenticator (thereby unable to provide the code). Secondly, a lockscreen (requiring either code or password) would not be helpful for the user's privacy. If another person can access the browser, they can retrieve all these information from the javascript console anyway. If the person cannot access the browser, they can looked up all information on blockchain as long as they know the addresses of the user's wallets.

[polymorpher]

For the above reasons, I am going to close this issue. Let me know if you disagree