Should our application ask for users master password when needed or at application start?

Question

Our application may contact different servers using background processes to update local data. Some servers require authentication, others don't. When accessing the first time a server, our application asks for the credentials and stores them in a master-password encrypted storage. When reopening the application, it needs to ask for the master-password to use the stored credentials (similar to Firefox). As you can imagine, this can happen when the user does not expect it (in contrast to Firefox), because of the background processes.

What options do we have - ask the user for the master-password at application start, simply skip to connect the servers where authentication is required until the user provided the master-password using an explicit action?

Answer 1

I'd opt to a) check on startup to see if the required server credentials are still valid, or if a new session needs a fresh authentication, and if so, b) present the request for the master password at startup so that you can provide a nice smooth session that incorporates the background data.

The small tax of authenticating at the start of the session prevents interruption at a less optimal time, and can become a habit that, while a bit annoying, prevents bigger annoyance at less predictable times.

Answer 2

A few ideas:

• If you're doing background updates, why not use a background message? Similar to Google Chrome's top message bar: Something along the lines of "Log in to update".
• Similarly, if you're updating a table or list, you could post a message in the first or last row, asking the user to log in to see the latest data.
• Completely opposed to your question, but why do they need to log in again? Couldn't the client store the encrypted password and send that securely to the server and authenticate?