Implement a mechanism for Riot to generate and cache a user password

[lampholder]

The details of the new guest experience for Riot are on the project plan: element-hq/riot-meta/issues/59

We want to improve the experience for users landing as guest by giving them full access to Riot after they've picked a username and successfully completed a (accessible, privacy-concern-sensitive) CAPTCHA.

As part of this, completing registration with a password would be completed at a later stage, so Matrix/Riot need to support the user's existing/operating without a password.

The scope of this task is to make sure this is possible (it might be that no work is required).

If work is required, the 'right way' to implement this is down to the implementor - it could be to modify Synapse/the DB schema, it could be for Riot to generate a throwaway password that is not exposed to the user (or something else entirely).

[lukebarnard1]

If work is required, the 'right way' to implement this is down to the implementor

I'm not sure this should hold true... I think we should discuss, design and implement collectively.

[tessgadwa]

Agree with Luke.

…

On Apr 12, 2017 9:57 AM, "Luke Barnard" ***@***.***> wrote: If work is required, the 'right way' to implement this is down to the implementor I'm not sure this should hold true... I think we should discuss, design and implement collectively. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#3600 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGLNG5Qe6Y7B-iYRPHqLKY6umO5jijTaks5rvNhKgaJpZM4M55RT> .

[lampholder]

Okay :)

A summary of discussion so far - we are wedded to the idea of users being able to have full access without having to provide a password, so we would like to implement this by:

• Riot generating a password for the user and caching it locally (thereby not requiring any changes to the server impl to support passwordless users)
• Riot prompting the user to provide a password (using whatever combination of encouraging wording and UI works most effectively)

[lampholder]

So that would likely change the scope of this task to - implement a mechanism for Riot to generate and cache a user password, and it can come later in the sequence.

[lukebarnard1]

Ah, well let's change the title to that then :)

[lukebarnard1]

The generation is simple:

generateRandomPassword() {
    // Returns something like "yigddhuo6ucrbeyvh35v78pvi",
    // but not always of the same length
    return Math.random().toString(36).slice(2);
}

As to when we do this, and where this fits in with existing code, I'm not sure. It could easily go into the dialog to choose a mxid/do a capcha before it calls through to hit an InteractiveAuth of some flavour. This needs a bit more thought.

[lukebarnard1]

Done in the initial implementation of mxid dialog matrix-org/matrix-react-sdk#849