Streamline onboarding flow

[bdresser]

We can simplify the onboarding flow with the following:

• add ToS checkbox + link to password screens
• remove "privacy warning" as it's explained during 1102 / enable flow
• add security warning to Jazzicon intro step
• introduce import vs. create step

See flow here

[danjm]

@bdresser should the "Terms Of Service" in "I agree to the Terms Of Service" link somewhere?

[cjeria]

I've made some updates to the flow including:

• removed account image step and account image from flow altogether
• added necessary back buttons in the flow
• updated create/import wallet screen
• updated buttons to match new UI
• added "congratulations" screen at the end of the new wallet flow.
• removed progress dots [•••]

See updated flow in figma here

[danjm]

@bdresser Are we removing the phishing warning screen as well?

[danjm]

@cjeria @bdresser Are we certain we want to remove all mention and display of identicons? Have we decided it is not useful as an anti-phishing and security measure?

[bdresser]

I think we need a security reminder and should keep either the phishing warning or the account image. Ideally they can be combined in to a single informative step. In the first mock, I added extra text to the account image step to encompass some of the phishing warning. Let’s chat live today or in design sync tomorrow.

…

On Wed, Feb 20, 2019 at 7:57 AM Dan J Miller ***@***.***> wrote: @bdresser <https://github.com/bdresser> Are we removing the phishing warning screen as well? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6163 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA-Bft2r0Ux88wOltBCRL05iBwIDLZuRks5vPXB-gaJpZM4a8bzv> .

[cjeria]

The account image step was something I introduced back when I first redesigned the onboarding flow (before the new UI design even started) because I saw it as an opportunity to educate users about what the image represents (since you can't change it). There is no data that suggest it's useful in any way aside from its educational value.

There's a lot of new things we need to educate new users about. Is account image top of the list? The way I think about is that we should educate users on the bigger problems they face.

• Account loss due to not storing seed phrase properly
• What's a private key
• No way to recover your password or "forgot your password?" button
• Phishing attacks
  etc.

@bdresser do you have data that suggest phishing attacks is top of the list? As far I recall, users run into issues losing their seed phrases more so than I hear about phishing attacks. cc @dpazdan @omnat Thoughts?

Perhaps we should leverage do a little more research into this question as opposed to deciding/defending a hunch?

[cjeria]

I should mention, I'm not opposed to reintroducing the account image. Was just aiming to streamline the flow as the title suggests 😉 .

[bdresser]

@cjeria you're right on several counts -- we have no data that can tie the account image step OR the phishing warning step to any change in behavior. We haven't measured these things, and we still don't.

I also agree that lost seed phrases are a more pressing issue than phishing, but maintain that they're both important issues and that phishing is harder to identify and track.

There is a ton of information we need to gather around onboarding, both qualitative and quantitative. To me, this issue just represents the "no-brainer" changes we can feel comfortable making in advance of that research.

Going from TWO phishing / security warnings to NONE seems dramatic, borderline reckless. Since we know there are phishing campaigns out there targeted specifically MetaMask users, I would err on the side of caution. The account image is also a legitimate security measure that makes phishing more challenging, and is industry standard. (Status & Coinbase both implement a version of this.)

If future research or analytics can show that the warnings have no effect on behavior, I will feel more comfortable removing them.

[dpazdan]

fwiw, we see slightly more tickets referencing lost seed phrases, over phishing/hacked cases, though not by a huge margin. ~30% more