[Bug]: Exposing node seed words is asking for 2 passwords and the second could be forgotten #127

Closed
opened 2026-07-29 13:42:22 +00:00 by ssmithx · 2 comments
Collaborator

Description

When you want ot expose the node seed words or QR, you are prompted for password, totp, and backup passphrase ( only if different...)
The backup passphrase is the original password that archipelago makes you create on install.
This could be forgotten

Steps to Reproduce

Click reveal recovery phrase from settings

Expected Behavior

Use knows what to type in

Actual Behavior

Use might not have known that their initial password has become their "backup recovery phrase"

Archipelago Version

1.7.118-alpha

Hardware

x86_64 (Intel/AMD)

Relevant Logs

No response

Screenshots

No response

### Description When you want ot expose the node seed words or QR, you are prompted for password, totp, and backup passphrase ( only if different...) The backup passphrase is the original password that archipelago makes you create on install. This could be forgotten ### Steps to Reproduce Click reveal recovery phrase from settings ### Expected Behavior Use knows what to type in ### Actual Behavior Use might not have known that their initial password has become their "backup recovery phrase" ### Archipelago Version 1.7.118-alpha ### Hardware x86_64 (Intel/AMD) ### Relevant Logs _No response_ ### Screenshots _No response_
Author
Collaborator

Better flow maybe:
Do NOT have a recovery password unless one is set explicitly.

Better flow maybe: Do NOT have a recovery password unless one is set explicitly.
Collaborator

Fixed in d79ca540 and pushed to main.

The separate backup-passphrase field is now progressively disclosed: the initial reveal asks only for login password (+ 2FA when enabled), and the extra passphrase appears only when the backend reports that the login password could not decrypt the saved seed. Regression test covers the full transition.

Verification: targeted regression tests passed; full frontend suite passed (120 files, 1010 tests); type-check and production build passed; built bundle contains the new UI. Closing as fixed.

Fixed in `d79ca540` and pushed to `main`. The separate backup-passphrase field is now progressively disclosed: the initial reveal asks only for login password (+ 2FA when enabled), and the extra passphrase appears only when the backend reports that the login password could not decrypt the saved seed. Regression test covers the full transition. Verification: targeted regression tests passed; full frontend suite passed (120 files, 1010 tests); type-check and production build passed; built bundle contains the new UI. Closing as fixed.
chaum closed this issue 2026-08-30 14:26:43 +00:00
Sign in to join this conversation.
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: lfg2025/archy#127