From cd98bc6603e1c27c88e27bd5108c3b5f42e870c7 Mon Sep 17 00:00:00 2001 From: Russell Ballestrini Date: Tue, 2 Jun 2026 17:51:55 -0400 Subject: [PATCH] zebra-spaces: log-out confirm spells out the irrecoverable consequences The pubkey IS the user's identity: host claims, room reservations, cohost grants, meeting-life blocks all key off it. Without a vault backup, logging out is one-way. The old confirm() prompt was a single line that didn't convey 'you cannot be you again' clearly enough. New prompt: - prints the full pubkey hex so the user can copy it before clicking OK (panic-safety net) - enumerates exactly what they lose - ends with the recovery path ('backup / restore') Wording chosen to nudge a backup BEFORE confirm, not to scare-off intentional log-outs. --- web/zebra-spaces.html | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/web/zebra-spaces.html b/web/zebra-spaces.html index e609e4b..74701d9 100644 --- a/web/zebra-spaces.html +++ b/web/zebra-spaces.html @@ -1383,8 +1383,21 @@ $('btn-vault').addEventListener('click', () => $('vault-panel').classList.toggle * otherwise the page would refuse to enter any space (no identity). */ $('btn-logout').addEventListener('click', async () => { if (ws){ setStatus('leave the space first','err'); return; } - if (!confirm('Log out wipes your identity key from this browser. ' + - 'If you haven’t backed it up you cannot recover it. Continue?')) return; + /* destructive + permanent: the pubkey IS the user — it's how host + * claims, room reservations, cohost grants, blocks, and meeting-life + * blocklists key off you. Without a vault backup there's no way to + * be 'you' again from any device. Spell that out in plain language + * with the hex so the user can copy it if they panic mid-prompt. */ + const msg = + 'Log out will permanently destroy this identity in this browser.\n\n' + + 'pubkey ' + (myKeys ? myKeys.pubHex : '(none)') + '\n\n' + + 'After this:\n' + + ' • You cannot reclaim host on any space you opened with this key\n' + + ' • Cohost / speaker grants tied to this key are gone\n' + + ' • The only way back is "backup / restore" — if you have not made a\n' + + ' backup, this is one-way.\n\n' + + 'Continue?'; + if (!confirm(msg)) return; try { localStorage.removeItem(ID_KEY); localStorage.removeItem(HANDLE_KEY); } catch(_){} myHandle = ''; $('handle').value = ''; myKeys = await generateIdentity(); @@ -3681,8 +3694,8 @@ logLine('', 'ready — pick a handle, type a rendezvous code, enter the space');