Kunzisoft / KeePassDX

Lightweight vault and password manager for Android, KeePassDX allows editing encrypted data in a single file in KeePass format and fill in the forms in a secure way.
https://www.keepassdx.com/
GNU General Public License v3.0
4.3k stars 259 forks source link

Device as external keyboard #80

Open ghost opened 6 years ago

ghost commented 6 years ago

Basically, simulate a keyboard when plugged into a computer.

This is really useful if you're using a computer at say, work or school and therefore can't install Keepass XC.

J-Jamet commented 6 years ago

By computer, you mean a Chromebook with Chrome OS ? I have not tested on this platform yet. I will look at how it works to improve the application.

ghost commented 6 years ago

No. Any computer.

Just like https://github.com/whs/K2AUSBKeyboard

justintime4tea commented 6 years ago

Oh I see, use the phone as a virtual keyboard for the computer. So you can hit "type/go" on the app and it types on the computer over the USB. Nifty.

J-Jamet commented 6 years ago

Ha ok, it is a feature that can interest me too, why not in the future. I have to look at the compatibility of the drivers, it must depend on the phones.

justintime4tea commented 6 years ago

From what I'm reading it looks like this K2AUSBKeyboard app (and others like it: https://github.com/pelya/android-keyboard-gadget) require a custom driver (and root on phone) which implements/adds /dev/hid device to work as keyboard.

Another option would be to have a desktop "companion" app that would work with KeePassDX but that wouldn't satisfy the requirements of not installing software on the Desktop.

You could also use an Arduino (or similar tiny maker board) powered by and connected to the phone as a keyboard device and connect phone -> arduino -> pc and VIOLA! :) This sounds like an awesome project and if I ever find the time I'd love to work on something like this.

PacoBell commented 6 years ago

You shouldn't need custom drivers or root to accomplish this on Android. You just need to implement the Android Open Accessory Protocol 2.0.

Normally, the HID device is a peripheral connected to a USB host (i.e. a personal computer), but in AOA the USB host can act as one or more input devices to a USB peripheral.

justintime4tea commented 6 years ago

@PacoBell, what you linked to is for controlling an Android device via a device connected to the Android (such as Bluetooth speakers, gamepad, etc...) It allows a device connected to the Android to act as a mouse, keyboard,is or other HID device. What poster was suggesting was to turn Android into a keyboard for use with a computer (the reverse of what you linked).

zeekoe commented 6 years ago

Did you start work on it yet? I just started using keepass and figured it might be relatively easy to hook up DotDash keyboard source code to KeepassDX. DotDash already has about the right number of keys ;)

J-Jamet commented 6 years ago

Not started yet, nice if you have an easy way to implement the code. I don't know dotdash, do you have a link for the code and to contact the owner of the code?

konkav-js commented 6 years ago

This sounds interesting. Is there a possibility, to emulate bluetooth HID with android phone? If the USB HID is impossible without root and custom driver, the BT may be an option. As for the hardware route: raspberry pi zero w could be used. I think it is relatively easy to have the rpi USB to emulate a HID device, and a phone then could connect to the rpi over BT or WIFI. Or, a maple mini clone paired with HM-10 BLE (clone). Maple has an STM32F103, its USB could simulate the keyboard, and the HM-10 BLE, connected over serial port, could be used to connect to phone.

konkav-js commented 6 years ago

I found an Arduino library for STM32 for USB HID here . And it could be even connected with NFC reader too :)

zeekoe commented 6 years ago

DotDash Keyboard (Morse code keyboard) is on FDroid - https://f-droid.org/app/net.iowaline.dotdash

Source is here: https://github.com/agwells/dotdash-keyboard-android/blob/master/README.md

zeekoe commented 6 years ago

I just succeeded to merge the two sources in one & have it all working: https://github.com/zeekoe/KeePassDX/tree/keyboard Didn't ask the dotdash author yet. And now trying to get real functionality working, but I don't think I will get far with that today. Feel free to continue, I'll push everything.

zeekoe commented 6 years ago

I did manage with little effort to get a PoC working on my phone, lots of cleanup work is still needed.

@agwells what do you think of me using your code as a base for this? If I'm correct, license-wise I'd need to remove the images and create new ones to have all of it GPL compatible, right?

agwells commented 6 years ago

Lol, I'd be honored. :)

That said, if you just need a super-simple keyboard, DotDash might be overkill. For a minimal Android keyboard, I think all you need is a KeyboardView, an InputMethodService, and a layout XML file. DotDash has some additional things, like gesture handlers, "cheat sheet" popups, subclassing "Keyboard" to dynamically modify the keys, etc. But feel free to use DotDash as a starting point, and strip out what you don't need.

If I'm correct, license-wise I'd need to remove the images and create new ones to have all of it GPL compatible, right?

It's been a while since I looked at DotDash's code, but I see in the "NOTICE" file that it says there are APL-licensed images and code in it. So if you want to remove the APL stuff entirely, you'll need to strip out the code parts too. From a quick look at the codebase, I think it's the "onFling" method in the DotDashKeyboardView (which is used for bringing up the Morse code cheat sheet), and the AutoSummaryListPreference class (which provides a widget on the keyboard's preferences screen): https://github.com/agwells/dotdash-keyboard-android/commit/9b99c2f334e72dcdb1448283ab97abb58c339c11#diff-942b7e2bcd8a13882e50c5e8d5a7a15b

agwells commented 6 years ago

Oh, come to think of it, there are also quite a few APL-licensed XML files in there too. Back when I updated the keyboard's appearance, I used the images and styles from the AOSP keyboard, so that's a bunch of image files and XML files.

Here's the commit where I added all of those. Annoyingly, the AOSP keyboard actually doesn't use the stock KeyboardView class, so the stock KeyboardView has a very different, very Android 1.6 appearance.

https://github.com/agwells/dotdash-keyboard-android/commit/6a2aeb6d2157171c8200da26dfab948a0c4b5fe2#diff-29adca6f946cb4179803b339ec776fd2

J-Jamet commented 6 years ago

Thank you @agwells ! You did a really great job with dotdash and It's really informative (and I didn't know APL, shame on me! :'/ ) As you said, it may be overkill for our use, but we will be able to add features much more easily thanks to you :+1: @zeekoe Thank you too for your work, the merge work well. I was inspired by your work to make a keyboard start from scratch with a specific theme, there is still work to do but it goes ahead. I will first make a light keyboard that will just inform the elements of an entry (#15) (with a keyboard change facilitated). Then a full keyboard and after the features described by konkav-js to easily type a password everywhere! :) @konkav-js I will ask you more precisely when I will be in this part and that I will have ordered the different material.

Thank you guys, It's nice to see these posts on this kind of topic! :)

zeekoe commented 6 years ago

Ah, I should've posted all this in #15, my bad... Great to see this progressing. My work was nothing really, only bringing code & people together 😉

I see in your branch you did a lot of work already, nice! Need to try it out when I'm close to my computer again for sufficient time.

konkav-js commented 6 years ago

I have searched around a little, and have few ideas for this keyboard emulation.

  1. Bluetooth HID - all phones have Bluetooth, most laptops and some PCs also, and if a computer has no BT, it is a cheap dongle. If it is possible, to emulate BT HID on most phones, without root, then this is the best possibility. I found only one project, where root isn't mentioned, and it is a fairly new project: this

  2. Bluetooth module with USB interface - I was able to find only one chip with the mentioned possibilities, and it is the Texas Instruments CC2540. It is a BLE SoC, with 8051 core. On everyone's favorite online marketplace (ebay) there are complete modules for as low as 8$ (search for: cc2540 sniffer usb). There are even descriptions of using it for USB HID. Looks too good to be true? Well, yes. There is only one development platform for it, the IAR, and it has no price on the web page. Searching on forums, I found prices in around 3.000 USD.

  3. USB capable MCU, and a wireless module - here comes those microcontrollers, which have USB interfaces, like STM32F103 (Maple Mini), or ATMega32U4 (Arduino Leonardo). Both of these could be programmed with Arduino. The Leonardo has an advantage of being an Arduino board, so it is directly supported (here is the Arduino USB HID description), and for some 5$-6$ you could find modules with USB connectors made on PCB for directly plugging in on computer, on ebay search for: badusb, or beetle atmega32u4. On the other hand, the Maple has a more powerful MCU (32 bit 72MHZ versus 8 bit 16MHZ). As for the wireless connection, there is a whole bunch of modules. There are BLE modules (here is a review of quite few of them), there is a WiFi module (ESP8266), the WiFi+Bluetooth module (ESP32), and even NFC (although this is pricey).

  4. Raspberry Pi Zero W - I think, the worst possibility. It is running a full Linux, and that don't like the random plugging in/out.

From above, I was thinking of ordering a BadUSB and HM-10. It can be found on ebay for under 10$ for both. Although I never did anything with Bluetooth, I think it wouldn't be too hard to make the firmware in Arduino.

And then, in some forum, I stumbled on this. Just what I was thinking of doing. So, this is the end for me, I don't see any reason to reinvent the wheel. (Just for information: he used the STM32F103 :) the world of microcontrollers is small).

@J-Jamet so if you would like to do it yourself, here are some HW informations. It's not too complicated, and with Arduino, a basic firmware is going to be easy.

zeekoe commented 6 years ago
  1. 2x ATTiny45, 6 resistors and two (zener?) diodes could also do the trick and is my bet for the lowest hardware count. These devices don't need a crystal. Both of them can be USB slave, but then some clever protocol needs to be programmed to get data from one to the other. Software-wise I can imagine this would be more complicated than the other options.
konkav-js commented 6 years ago

@zeekoe I have no idea, how would you transfer data from phone to the Tiny?

I am looking at my phone, and it has the next options for USB: MTP (file system share), PTP (webcam like thing), RNDIS (USB ethernet), Audio Source, MIDI and USB debug (adb), And I must say, that this is not a factory ROM, so a random phone with factory ROM would have less than this. Most of the above protocols are resource hungry (compared to 8bit 20MHz AVR), maybe the MIDI is not so much. But I think, if someone is making a hardware, then he should make it wireless at least.

Maple Mini clones could be bought for as low as $2 shipped (I do have a few), and a HM-10 BLE module for $2.5. At the same place, 2pc of ATTiny45 are $3.8, and these are chips only, while the above are complete modules, with connectors, PCB antenna, voltage regulators, and all else. In reality, one would just need to solder 4 wires together (VCC, GND, TX, RX), and have the hardware development finished. So, if the size of the electronics is not limited, I don't think that one could do better than the two module, except if one is going to make at least hundreds of it for sale.

zeekoe commented 6 years ago

Hmm, sad that complex hardware is cheaper nowadays than good ol' Atmel's. I wouldn't want my passwords to be transmitted wireles... ATTiny45's are US $1,20 per piece with free shipping on eBay BTW. What I'm thinking that should be possible is to implement a USB serial slave on one, and a USB keyboard on the other, and then some kind of serial (either UART, or custom protocol). https://github.com/mik3y/usb-serial-for-android => it seems possible on the Android side, too.

konkav-js commented 6 years ago

Well I didn't know about that usb serial thing (and I just got an idea for a new project). Although last commit was some two years ago, but it supports CP2102 (my favorite usb serial converter, I am uploading firmwares on ESPs with almost 1Mbaud, without a problem). So, one of the Tiny could be replaced with a CP2102 module, and with this, one could halve the SW development. (A quick search on ebay, CP2102 modules, with usb A connector, goes as low as $1.2, so one could maybe use the usual usb cable for connecting the phone. Or not, if it is needed for the phone to be in OTG mode). "I wouldn't want my passwords to be transmitted wireles..." I presume, that you never connect over wifi then ;) The STM32 is powerful enough, to implement an encryption. But I think, that there is greater chance to get a malware on PC, than to got sniffed the BLE connection.

ERIIX commented 5 years ago

I use InputStick with KP2A. It allows me to set an encryption key on the stick so that the data is double encrypted in transit (encrypted by Bluetooth, then by the key). Works great for me, and it's the one thing that makes me keep it around even though I like this one much better. Is there anyplace we could post some bounty on support?

jmichael2497 commented 5 years ago

based on the initial releases of 2015 and updates (or lack thereof) since, it seems like they prioritized ios rather than android (just looking at the readme for both to see who gets more detail), nothing marked release for android while ios has several releases marked.

and despite marketing the "gamepad" profile as a feature, they don't actually provide one, just keyboard, mouse, multi-media remote controls still, for a 4 year old and $40 dongle.

and i wonder about the security, probably better to use the more involved IPC vs easy broadcast, otherwise afaik other apps could intercept the broadcasts, and it would be just the same as being exposed to a clipboard monitor spy, right?

but interesting idea, like the logitech wireless dongle (proprietary not quite bluetooth), but better because it uses some actual standards. https://github.com/inputstick

schlomie commented 5 years ago

Just a heads up - With Android 9 - Pie, Bluetooth auto-typing is possible without any extra drivers, dongles, kernel changes or anything. Proved out in the latest version of https://github.com/tejado/Authorizer

It works exceptionally well.

J-Jamet commented 4 years ago

Usefull links: