search

Kunzisoft / KeePassDX

Lightweight vault and password manager for Android, KeePassDX allows editing encrypted data in a single file in KeePass format and fill in the forms in a secure way.
https://www.keepassdx.com/
GNU General Public License v3.0
4.29k stars 260 forks source link

Brief Password Visibility During Auto-Fill with KeePassDX Keyboard #1765

Closed maninthemiddle01 closed 4 months ago

maninthemiddle01 commented 4 months ago

I've encountered an issue with the KeePassDX keyboard when auto-filling passwords into fields. The password is briefly visible (for about half a second) before it's obscured by the usual bullet points or asterisks. I believe this could be related to the delay in the password field masking the characters as they're entered.

Steps to Reproduce:

  1. Open an app or website login page.
  2. Use KeePassDX auto-fill feature or KeePassDX keyboard to input the password.
  3. Observe that the password characters are briefly visible before being hidden.

Expected Behavior: The password should be obscured immediately as each character is entered, with no delay that allows the characters to be visible.

Actual Behavior: The password briefly flash on the screen, fully visible, before being obscured by bullet points or asterisks.

Possible Solutions:

Additional Information:

I understand the password is still secure, but I would prefer it to remain hidden throughout the input process for additional security. Thank you for your time and for the great work :)

J-Jamet commented 4 months ago

This is not KeePassDX behavior. You said so yourself : I believe this could be related to the delay in the password field masking the characters as they're entered.

KeePassDX does not manage the visual behavior of the form to be filled in. And to my knowledge, the keyboard has no option to influence this behavior.

Contact the developers of the application that runs the form rendering engine: your "mainly browser"

maninthemiddle01 commented 4 months ago

Thanks for the clarification. I understand that KeePassDX does not manage the form's visual behavior, but since the issue is observed when using the KeePassDX keyboard for auto-filling, might there be any scope for addressing how the keyboard dispatches input to ensure immediate masking? Any enhancements in the keyboard auto-fill functionality could potentially minimize this visibility window and improve user's security.

cbiere commented 3 months ago

There is an ingenious setting in Android called "Show passwords" to "Display characters briefly as you type". Maybe this has some effect?