toddlv Hey there, nice update! I like this approach much better. The setup was smooth, although I had to create and fund a new account. I received a message about my other account having keys that the site didn't recognize.
Fundamentally I like how this works. I understand there is always a balance between security and convenience, to me personally this is a step in the right direction.
During the PIN setup process I can tell you spent time trying to really explain everything in detail. I get it, you're trying to build trust. On the flip side I think you could be over-explaining things to the point of diluting the value of your service. This is what I'm referring to:
"Entering a PIN encrypts your new signing key in your browser (using the PIN) and sends it to Lumen Vault for storage so that you can use your wallet on any device without having to remember your long signing key or copy/paste it everywhere.
The PIN is not saved in Lumen Vault. Instead, your PIN will be used to decrypt your signing key any time you need it to sign a transaction.
If you don't want your encrypted signing key to be sent to Lumen Vault and would rather enter your signing key every time, save this signing key on your computer and click Skip Pin."
That first sentence is really wordy. Then it talks about decryption and signing transactions. Then it ends with, "also, you don't even have to use it." You're asking people to process a lot information here.
To me the value prop of the product should be as simple as this: send Lumens quickly from any browser using just your email account and a PIN. From a consumer standpoint the whole discussion about a second set of keys should just go out the window. As long as I know that the master key is my responsibility - and it's my way out if I should decide to leave the service - forget about making people try to decipher key weights, secondary keys, and encryption using a PIN. That's the value of your service, they don't have to think about it.
You're going to get pushback from some people saying there is no way they can trust you or this service, and you must open source your encryption code, my only comment would be this product shouldn't be targeted at them.
