1060168 - [RPP] remove the password from the DB

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia, defect)

Description

[marta]

Once Location/Lock/Remote Wipe Remove password from the database. Make sure the “first time use” launches next time the privacy panel is opened.

Comment 1

[agnieszka.baranowska]

Password should be removed from the database at the moment when an SMS listener receives an SMS and detects the SMS as FmD SMS.

Marta, please confirm.

Comment 2

[agnieszka.baranowska]

Does it mean that user will have only single opportunity to send FmD SMS?
If we have 'hide FmD SMS' functionality, it won't be necessary remove password, yes?

Marta, please answer.

Comment 3

[marta]

No. The password should be removed once the user gets the phone back and unlocks it. Exemplary workflow:
1. I lost my device and need to locate it
2. I send an SMS to my number from friends phone
3. My phone activates the "locate_me(function) and sends back to my friends phone SMS with the GPS coordinates.
Also my phone locks itself.
4. I go to the location and find my device. 
5. I unlock my phone
6. The password is removed from the DB and app asks to set a new password.

We need to do that for locating, wiping and locking the device. The password should be reset after the phone is unlocked, not once it receives the SMS. We need to do it anyway, cause even hidden SMS can be resent later on by the person who's phone was used earlier.

Comment 4

[agnieszka.baranowska]

Should it (resetting password) be automatic or manual process? Because if manual process is enough, there is such functionality already designed. I mean this link 'Forgot/change your pass phrase?' below input to enter password. I mentioned about it in comment to 'Bug 1060157 - [RPP] Main panel' (https://bugzilla.mozilla.org/show_bug.cgi?id=1060157#c4).

Comment 5

[marta]

It should happen automatically. We cannot relay on the user to remember to reset his password. Possibility of resending a message with the already used password and activating the command again has too high security impact. The phone should not allow for any further usage of the functionality (go back to the "factory mode" of that app) once the functionality has been activated and later deactivated.

Comment 6

[agnieszka.baranowska]

Attachment: https://github.com/mozilla-b2g/gaia/pull/23907