Public Access
jaap-jan
0e8fe4fc80
- The Windows CNG key and the macOS keychain tag were one name for every profile, so signing out of the nightly deleted the key the release build's device unlock was sealed to. DeviceKeyNames keeps the existing name for the default profile and gives every other profile its own; sign-out deletes only its own key, and a profile sealed before this keeps reading the shared one. - DevicePinWindow named two palette resources that do not exist and loaded itself with AvaloniaXamlLoader.Load, which never assigns the named fields, so it threw on construction and no PIN prompt was ever shown. A layout test now builds it against the real palette.
63 lines
2.8 KiB
XML
63 lines
2.8 KiB
XML
<Window xmlns="https://github.com/avaloniaui"
|
|
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
|
|
x:Class="DodoSSH.Client.App.Views.DevicePinWindow"
|
|
Width="420" SizeToContent="Height"
|
|
CanResize="False" ShowInTaskbar="False"
|
|
WindowStartupLocation="CenterOwner"
|
|
Background="{StaticResource Panel}"
|
|
Title="DodoSSH">
|
|
|
|
<!--
|
|
The PIN that unseals this machine's device key, on Linux and nowhere else.
|
|
|
|
◆ A WINDOW, WHERE EVERY OTHER QUESTION THIS APPLICATION ASKS IS A CARD.
|
|
|
|
ConfirmDeleteCard, HostKeyCard and the rest are overlays bound to view-model state, and that is the
|
|
right shape for a question about the vault: the shell owns the moment and the Android head shows the
|
|
same one. This is not that kind of question. It belongs to a platform integration — LinuxDeviceKeyStore
|
|
— and the shell it would otherwise live in is shared with the phone, which has a fingerprint and must
|
|
never grow a PIN box. Keeping it here keeps DodoSSH.Client.Shell platform-neutral, which is the
|
|
property IDeviceKeyStore exists to protect.
|
|
|
|
◆ AND IT IS DELIBERATELY PLAIN.
|
|
|
|
Windows and macOS draw their equivalent themselves — a secure desktop and a system sheet — and this one
|
|
cannot be either. Dressing it up to look like a system dialog would be teaching people that a
|
|
convincing DodoSSH PIN box is a system dialog, which is the phishing this platform's design cannot
|
|
prevent and should not rehearse. It says what it is, it names the application, and it stops there.
|
|
ADR 0007 records the difference rather than smoothing it over.
|
|
-->
|
|
|
|
<StackPanel Margin="20" Spacing="12">
|
|
|
|
<TextBlock Classes="heading" FontSize="15" x:Name="Heading" TextWrapping="Wrap" />
|
|
|
|
<TextBlock Foreground="{StaticResource TextDim}" FontSize="12" TextWrapping="Wrap"
|
|
x:Name="Explanation" />
|
|
|
|
<!--
|
|
RevealPassword is off and there is no eye button. A PIN is short enough to retype and this box is
|
|
open on a screen somebody may be sharing.
|
|
-->
|
|
<TextBox x:Name="Pin" PasswordChar="•" PlaceholderText="PIN" FontSize="14" />
|
|
|
|
<!--
|
|
Only when choosing. A mistyped PIN at registration is not recoverable in any useful sense: the key is
|
|
sealed to it, and the only way back is to withdraw the device and register again. Asking twice costs
|
|
one box.
|
|
-->
|
|
<TextBox x:Name="Confirm" PasswordChar="•" PlaceholderText="PIN again" FontSize="14"
|
|
IsVisible="False" />
|
|
|
|
<TextBlock Foreground="{StaticResource WarnText}" FontSize="12" TextWrapping="Wrap"
|
|
x:Name="Problem" IsVisible="False" />
|
|
|
|
<StackPanel Orientation="Horizontal" Spacing="8" HorizontalAlignment="Right">
|
|
<Button x:Name="Cancel" Content="CANCEL" />
|
|
<Button x:Name="Accept" Classes="accent" Content="UNLOCK" />
|
|
</StackPanel>
|
|
|
|
</StackPanel>
|
|
|
|
</Window>
|