RFE: require only one "touch" when there's a password about yubioath-android

[dainnilsson]

You're not doing anything wrong, the user interface for this is not ideal. Unfortunately it's hard to do it in a better way. The authentication is done via a shared secret, stored on the device and derived from your password and a salt. As the app is capable of saving passwords, and the password is optional, the app does not initially know if you will need to provide a password or not until you tap the device. At that point it needs the shared secret to authenticate to the YubiKey, and prompts you for it. You give the password and the shared secret is then derived, but a second tap is needed to actually use the secret to authenticate and calculate the credentials.

The interaction when storing the password on the phone requires only one tap.