[OOBE] please provide passcode/passphrase in intial setup screen

[Jamie Strandboge]

Ubuntu Touch will soon have/now has the ability to set a PIN/password for the user. This should be configurable via the initial setup screen per Phone Delivery requirements. How this looks needs design, but the basic idea are there are 3 choices for the user: PIN, password and no password. PIN should be the default and appropriate language should be used for discouraging setting the device with no password. This is a requirement for RTM.

For a future consideration: an 'encrypt user data' option should be available when the user sets a password (but not a PIN, since using a PIN for an encryption key is not a useful security measure).

[Jamie Strandboge (jdstrand)]

Olga, can you mark your task as 'Critical' when you get a chance? (Updating rtm14 tagged bugs with what others are doing).

[John Lea (johnlea)]

@jdstrand; Olga is working on this atm

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Michael Terry (mterry)]

I've got an unattractive but functional version in a merge proposal now. When Olga gets me beautiful visual designs, I can improve with a second iteration.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-system-settings - 0.3+14.10.20140812.3-0ubuntu1

---------------
ubuntu-system-settings (0.3+14.10.20140812.3-0ubuntu1) utopic; urgency=low

  [ Ken VanDine ]
  * [battery] Updated based on latest designs, switching from brightness
    slider to progression which loads the brightness plugin.
    [brightness] Moved BrightnessSlider component to brightness plugin,
    since it's now only used in one place. (LP: #1289470)

  [ Sebastien Bacher ]
  * system-update: tweaks to the "no update available" label (LP:
    #1348568)

  [ William Hua ]
  * Use gsettings-qt in language panel.
  * Add auto-punctuation and keyboard vibration options. Also fix auto-
    completion to be auto-correction per spec. (LP: #1352398)

  [ Michael Terry ]
  * Implement a lock security page in the wizard. This page is super
    ugly right now and just the bare bones functionality needed to set a
    passcode or otherwise. Design is working on final visual design and
    we will update later. (LP: #1348362)

  [ jonas-drange ]
  * [cellular] uis for default SIM settings
  * [cellular] use expandable to show/hide sim editor and put the sim
    editor in a Loader element to optimize single sim setups
 -- Ubuntu daily release <email address hidden> Tue, 12 Aug 2014 19:23:51 +0000

[Olga Kemmet (olga-kemmet)]

As already mentioned to M. Terry: A passphrase option should't be included into the OOBE experience. It is enough asking the user to set a PIN for basic security. If a user is very concerned about personal data and would like to secure it further via encryption/passphrase, this option is available by simply going into the system settings. Plus, there is no personal data to protect if the phone was just booted out of the box

[Jamie Strandboge (jdstrand)]

I disagree with this assessment, it is counter to the future converged experience and I'm not comfortable giving security signoff for this (it does not meet requirements set out in https://wiki.ubuntu.com/SecurityAndPrivacySettings/ProtectingUserData: "Provide configurable PIN/password support (should support both a PIN and password)").

In the OOBE, we should default to PIN, but allow passphrase for heightened security and swipe to unlock for no security. I don't particularly care how this is presented in the UI so long as PIN is default and swipe to unlock conveys something about data not being protected. Users wanting heightened security should not have to set a throwaway PIN to then have to hunt for how to change it-- this is a bad user experience and we will likely be criticized in reviews.

Furthermore, next cycle we plan to have encrypted user data and selecting encrypted user data will need to be part of the OOBE and a PIN will not be allowed for use with encrypted user data (the 'protections' in this case would be specious).

Lastly, for a fully converged experience, users will not want to use a PIN to protect their desktop and we will need to accommodate for that.

Considering all of this, we should support passphrase as opt-in.

[Michael Terry (mterry)]

We don't have the final designs yet, so shouldn't the ubuntu-ux task be in progress?

[Olga Kemmet (olga-kemmet)]

That is correct. I changed it back to IN PROGRESS because new visuals are still missing.

[Benjamin Keyser (bjkeyser)]

The visuals are in development now and will be delivered on Monday.

[kevin gunn (kgunn72)]

thanks, just put unity8 back to "new" and we'll get it lined up
and lowering the priority since we have something in place.

[Antti Kaijanmäki (kaijanmaki)]

please note the final resolution on "PIN code" vs. "Passcode":
https://bugs.launchpad.net/unity8/+bug/1361114/comments/23

[kevin gunn (kgunn72)]

@Giorgio 10/16 should be ok

[Michael Terry (mterry)]

@Antti, this branch does revert to passcode.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-system-settings - 0.3+14.10.20141010-0ubuntu1

---------------
ubuntu-system-settings (0.3+14.10.20141010-0ubuntu1) utopic; urgency=low

  [ Michael Terry ]
  * Complete the unlock security screens and update a host of other
    small design issues. (LP: #1365034, LP: #1348362) (LP: #1365034,
    #1348362)
 -- Ubuntu daily release <email address hidden> Fri, 10 Oct 2014 18:02:19 +0000