Login flow UX improvements #19
Description
I want to display information about the application where the user is signing in. This information should be clearly visible so that it is clear where the user is signing into.
wallets
For the LN wallet flow, the only feasible place to do this is on the web interface. When using a Lightning wallet, the web should prompt the user if they're actually ready to sign in and only redirect once the user agrees and checks that they're using the right identity (name + email should be made visible to the web, this should be safe since the user has proven that they are who they are using a signature). This prevents accidental logins using the wrong identity or into the wrong application for example.
keychains
On custom clients (keychains), the application info can be shown in the client itself as well. Once scanned, the web should prompt the user to verify which identity they're going to use in the keychain application itself. Since we can't leak emails or usernames just based on knowing a device public key and don't want to leak the correct k1 signature until after the user decides to sign, we could include a separate challenge to retrieve the correct username / email for the device's public key.
The simpler but less user-friendly alternative would be to not show the email at all and just prompt the user to make sure they're selecting the correct identity in the keychain.
Another alternative would be to use the same flow as on the LN wallets. Just show the user info after the signature is presented and allow the user to change their mind if they accidentally use the wrong identity.