error when using insecure identity on mainnet

no warning on non-mainnet (playground, local replica)

e2e/tests-dfx/identity.bash

@@ -186,15 +186,15 @@ teardown() {
   assert_eq '(blob "hello")' "$stdout"
 }
 
-@test "using an unencrypted identity on mainnet provokes a warning" {
-  assert_command dfx ledger balance --network ic
-  assert_match "WARN: The default identity is not stored securely." "$stderr"
+@test "using an unencrypted identity on mainnet provokes a hard error which can be surpressed" {
+  assert_command_fail dfx ledger balance --network ic
+  assert_match "The default identity is not stored securely." "$stderr"
   assert_command "${BATS_TEST_DIRNAME}/../assets/expect_scripts/init_alice_with_pw.exp"
   assert_command "${BATS_TEST_DIRNAME}/../assets/expect_scripts/get_ledger_balance.exp"
   dfx identity new bob --storage-mode plaintext
-  assert_command dfx ledger balance --network ic --identity bob
-  assert_match "WARN: The bob identity is not stored securely." "$stderr"
-
+  assert_command_fail dfx ledger balance --network ic --identity bob
+  assert_match "The bob identity is not stored securely." "$stderr"
+  # can surpress the error
   export DFX_WARNING=-mainnet_plaintext_identity
   assert_command dfx ledger balance --network ic --identity bob
   assert_not_contains "not stored securely" "$stderr"

e2e/tests-dfx/network.bash

@@ -99,13 +99,13 @@ teardown() {
 
   assert_command_fail dfx diagnose --network ic
   assert_contains "The test_id identity is not stored securely."
-  assert_contains "use it in mainnet-facing commands"
-  assert_contains "No wallet found; nothing to do"
+  assert_contains "in mainnet-facing commands"
+  assert_contains "you can suppress this warning"
 
   assert_command_fail dfx diagnose --ic
   assert_contains "The test_id identity is not stored securely."
-  assert_contains "use it in mainnet-facing commands"
-  assert_contains "No wallet found; nothing to do"
+  assert_contains "in mainnet-facing commands"
+  assert_contains "you can suppress this warning"
 
   assert_command dfx diagnose
   assert_not_contains "identity is not stored securely"

src/dfx/src/lib/environment.rs

@@ -3,12 +3,12 @@ use crate::config::dfx_version;
 use crate::lib::error::DfxResult;
 use crate::lib::progress_bar::ProgressBar;
 use crate::lib::warning::{is_warning_disabled, DfxWarning::MainnetPlainTextIdentity};
-use anyhow::anyhow;
+use anyhow::{anyhow, bail};
 use candid::Principal;
 use dfx_core::config::cache::Cache;
 use dfx_core::config::model::canister_id_store::CanisterIdStore;
 use dfx_core::config::model::dfinity::{Config, NetworksConfig};
-use dfx_core::config::model::network_descriptor::NetworkDescriptor;
+use dfx_core::config::model::network_descriptor::{NetworkDescriptor, NetworkTypeDescriptor};
 use dfx_core::error::canister_id_store::CanisterIdStoreError;
 use dfx_core::error::identity::NewIdentityManagerError;
 use dfx_core::error::load_dfx_config::LoadDfxConfigError;
@@ -17,7 +17,7 @@ use dfx_core::identity::identity_manager::{IdentityManager, InitializeIdentity};
 use fn_error_context::context;
 use ic_agent::{Agent, Identity};
 use semver::Version;
-use slog::{warn, Logger, Record};
+use slog::{Logger, Record};
 use std::borrow::Cow;
 use std::cell::RefCell;
 use std::path::PathBuf;
@@ -288,11 +288,23 @@ impl<'a> AgentEnvironment<'a> {
             identity_manager.instantiate_selected_identity(&logger)?
         };
         if network_descriptor.is_ic
+            && !matches!(
+                network_descriptor.r#type,
+                NetworkTypeDescriptor::Playground { .. }
+            )
             && identity.insecure
             && !is_warning_disabled(MainnetPlainTextIdentity)
         {
-            warn!(logger, "The {} identity is not stored securely. Do not use it to control a lot of cycles/ICP. Create a new identity with `dfx identity new` \
-                and use it in mainnet-facing commands with the `--identity` flag", identity.name());
+            bail!(
+                "The {} identity is not stored securely. Do not use it to control a lot of cycles/ICP.
+- For enhanced security, create a new identity using the command: 
+    dfx identity new
+  Then, specify the new identity in mainnet-facing commands with the `--identity` flag.
+- If you understand the risks and still wish to use the insecure plaintext identity, you can suppress this warning by running:
+    export DFX_WARNING=-mainnet_plaintext_identity
+  After setting this environment variable, re-run the command.",
+                identity.name()
+            );
         }
         let url = network_descriptor.first_provider()?;
         let effective_canister_id = if let Some(d) = &network_descriptor.local_server_descriptor {