appPrivateKey returned from the extension, app, and Leather is different

[0xc22b]

Severity

• Major (Unable to proceed on a journey)

Summary

Using Justnote as an example, when signing in with the Xverse extension, the Xverse app, and the Leather wallet, they return different appPrivateKey, causing different Gaia hub bucket addresses.

Reproduce steps

On the desktop, signing with the Xverse extension

1. On Chrome, visit justnote.cc
2. Click the Sign in button
3. Choose Sign in with a Stacks Wallet

On Android or iOS, signing with the Xverse app

1. Open Xverse app
2. Choose the web view tab
3. Enter justnote.cc in the URL bar
4. Tap Sign in button
5. Choose Sign in with a Stacks Wallet

Expected result

They provide the same appPrivateKey, so we have the same Gaia hub bucket address, and users can see the same data.

Actual result

They return different appPrivateKey.

Remark

The leather wallet also returns different appPrivateKey. I'm using [email protected].

[0xc22b]

I am also concerned about what would happen to current users. I believe it isn't difficult to fix the appPrivateKey to be the same between the Xverse app, extension, and Leather. But when current users upgrade their apps, they won't be able to access their current data anymore.

Is there a way to also mitigate this?