Kunzisoft / KeePassDX

Lightweight vault and password manager for Android, KeePassDX allows editing encrypted data in a single file in KeePass format and fill in the forms in a secure way.
https://www.keepassdx.com/
GNU General Public License v3.0
4.3k stars 259 forks source link

Password generator icon in launcher #1234

Open TahirJalilov opened 2 years ago

TahirJalilov commented 2 years ago

It will be very useful to have password generator section in the main menu.

Currently it's not possible to use KeePassDX if I want to register somewhere, because there's no password generator.

J-Jamet commented 2 years ago

Currently it's not possible to use KeePassDX if I want to register somewhere, because there's no password generator.

The password generator is available when creating an entry.

It will be very useful to have password generator section in the main menu.

I see a limited interest in generating passwords that will be lost but I plan to make another application just for password generation and create a separate icon on the launcher.

TahirJalilov commented 2 years ago

The password generator is available when creating an entry.

Yes, I know it. But it's not useful when you need to register somewhere. Or you prefer first add entry, generate password, copy it and then use copied password during registration?

I see a limited interest in generating passwords that will be lost but I plan to make another application just for password generation and create a separate icon on the launcher.

It should not be lost. KeePassDX should have possibility to generate and copy the password. At least will be nice to have password generator in inline mode. I don't understand why you think that create separate password generator app is better than just add already exist generator to the main menu of the KeePassDX?

Other password managers apps has this option.

J-Jamet commented 2 years ago

Yes, I know it. But it's not useful when you need to register somewhere. Or you prefer first add entry, generate password, copy it and then use copied password during registration?

Copying to the clipboard is very strongly discouraged as explained in this wiki page : https://github.com/Kunzisoft/KeePassDX/wiki/Clipboard Encouraging this practice would encourage constant use of the clipboard while KeePassDX is a security-oriented application.

At least will be nice to have password generator in inline mode.

The Autofill workflow already works for entry registration, so for the creation of a password generated from an entry. (If you don't mean autofill, what do you mean by inline mode?)

I don't understand why you think that create separate password generator app is better than just add already exist generator to the main menu of the KeePassDX?

I didn't say it was better to create a new app than add an icon to the history screen of KeePassDX. I just said I'll refactor the password generator code and add an icon on the Android launcher. Might as well have an icon on the launcher rather than on the database history screen if a database is not going to be opened anyway. (and how to access it if a database is bookmarked since the screen is skipped?)

The new password generator application will be more complete and will contain dictionaries for passphrases in several languages. If installed on the device, it will improve the internal password generator of KeePassDX so used independently as you like.

Other password managers apps has this option.

This is not a reason if functionally it is not suitable. If the neighbor jumps out of the window, do you also do it without thinking? If you describe to me a more secure and faster workflow, we can explore solutions.

TahirJalilov commented 2 years ago

Well, let's discuss in other way. I'll list you the steps that I have to do during registration somewhere. 1) Open web page or mobile app where I need to create new account 2) Fill username 3) Open KeePassDX 4) Go to some exist entry 5) Press edit button 6) Press password generator button 7) Copy generated password from the popup window 8) Press discard changes button (to not save new password for the exist entry 9) After that, I can use this generated and strong password to fill it on the registration window 10) If registration success, I have to add new entry manually to the database. Paste copied password and username.

Ho do you think, is it correct way? Maybe the problem with my phone, but I don't see any autofill button on password field during registration, and KeePassDX does'n ask me to store in db newly registered entry.

J-Jamet commented 2 years ago

From your workflow :

  1. Why use an existing entry? Your goal is to create a new entry. So you might as well create one and save it, pretty logical. ;)
  2. As I said it is completely discouraged to copy a password into the clipboard.
    1. 10 No interest if you have created an entry.

If your problem is that autofill is not displaying a popup, the form, browser or application may be preventing the autofill service from the device.

In this case, use the Magikeyboard :

  1. From the browser, share to KeePassDX to prefill the URL in the new entry.
  2. Fill the new entry, choose your password and other fields.
  3. Validate
  4. Back to the Magikeyboard
  5. Click on each button on the keyboard to fill in the fields on your web form.

For detailed explanations (with screenshots) : https://github.com/Kunzisoft/KeePassDX/wiki/Magikeyboard If the registration autofill is not blocked for your form: https://github.com/Kunzisoft/KeePassDX/wiki/AutoFill

TahirJalilov commented 2 years ago
  1. Why use an existing entry? Your goal is to create a new entry. So you might as well create one and save it, pretty logical. ;)

You mean, better is to create a new entry, save it in db before registration? And then delete it if registration will unsuccessful? I don't think that everyone do it like that. At least when using desktop app, normal flow is register first and then give permission for plugin to add new entry to the db.

J-Jamet commented 2 years ago

You mean, better is to create a new entry, save it in db before registration?

Yes, If you call "registration" the confirmation of the service you create an account for, I don't see any problem with that.

And then delete it if registration will unsuccessful?

You give up completely your registration to a service if you have an error that appears in the validation? I don't think it happens that often but in this case yes, just delete the entry, it's not a big deal.

At least when using desktop app, normal flow is register first and then give permission for plugin to add new entry to the db.

Computers are much more permissive than the Android system. If you have a better technical method with all the constraints of the system, feel free to propose your solution.

TahirJalilov commented 2 years ago

Ok @J-Jamet let me try to change registration flow in that way ))) But anyway I think that it will be nice to add password generator button somewhere in the main page under "+" button))) image

J-Jamet commented 2 years ago

Hoo, we didn't understand each other on the main page already, I thought you were talking about the database selection page. In any case, for me, if the generation of the password at this moment is neither linked to an entry nor to a database, there is no reason to put it on this screen. I think it should be done earlier, either by proposing a "generate free password" button (or something like that) in the autofill and in the keyboard. And if autofill is not available and you don't use the keyboard, I suggest a password generator icon on the launcher (not even a database needs to be open). This way you click on the password generator icon instead of the password manager icon.

TahirJalilov commented 2 years ago

Yesss!! Exactly what I suggest ))) sorry for my bad English )) Thank you for your patience )))

J-Jamet commented 2 years ago

I thought about this feature and in fact the interest is very limited to create an independent password generator application. As you normally don't have to copy passwords in the clipboard, I don't see how to pass the generated passwords in the forms without using the Magikeyboard or the Autofill.

So it's only useful for generating passwords that are temporary, but it doesn't fit your need to register in a service.

Aeyk commented 8 months ago

I would also like this feature, or at least generator option for custom fields. I use fields for security questions, and would rather use secret passwords then discoverable answers to the common security questions.

cbiere commented 3 months ago

I agree with Aeyk even if it's not quite the initially requested feature. I have some accounts with multiple "passwords" for different purposes and it's a pain to create them in KeePassDX. There should be a way to invoke the password generator within KeePassDX for more or all fields and not just the main password. At the moment, the only way is creating a new password, copying it and cancelling the change to the actual password or do the same with a dummy entry.