search

Kunzisoft / KeePassDX

Lightweight vault and password manager for Android, KeePassDX allows editing encrypted data in a single file in KeePass format and fill in the forms in a secure way.
https://www.keepassdx.com/
GNU General Public License v3.0
4.6k stars 270 forks source link

Android clipboard history keeps passwords after being copied #832

Open petersonj1956 opened 3 years ago

petersonj1956 commented 3 years ago

Describe the bug You describe me as a spammer, but right after I installed KeePassDX on my brand new Pixel 5, I immediately had my login and password stolen! You're trying to blow me off as someone who is harassing you, but that could not be farther from the truth. If you would take my input seriously, you might avoid more potential bad reviews. I know your program attempts to restrict the contents of the clipboard from being highjacked, but there maybe a hole in the Pixel 5 implementation that allows it. I continue to get a huge number of email from attempts to establish accounts under one of my login names (mainly from European websites, which I never logon to), and I have had attempts to charge items on my credit card. I'm just trying to give you and your users a potential "heads up", so you can intercept it. KeeFarce and clipboard issues are well documented Achilles heals of KeePass and other password management programs.

To Reproduce Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior A clear and concise description of what you expected to happen.

KeePass Database

KeePassDX (please complete the following information):

Android (please complete the following information):

Additional context Add any other context about the problem here.

J-Jamet commented 3 years ago

First of all, please fill in the problem template correctly, the fields are not there to look pretty and take up space if you don't delete them.

Then, you publicly accuse this open source application wrongly and it is very serious! Obviously I am taking the problem seriously as well.

PlayStoreComment Linked to #826

I took what you were telling me and responded by trying to stay calm, and to enumerate plausible scenarios for trying to help you but you were letting off steam on KeePassDX. (However, I don't think that starting by attacking someone and a community is the best way to get them to help you, don't you think? )

You kept saying over and over that there was a virus or trojan in the app completely slandering the work of everyone, so I was just asking you for the location of this malicious element in the source code. What you never gave me, obviously.

I know the code and if there is a problem I can of course try to resolve it quickly if it is based on concrete evidence and not on defamation claims.

Now "to inform users in an empathetic way (mhmhm)", you say there is a bug with the clipboard keeping the history. This subject has been covered many times. But I want to explain again (because I have time to waste, obviously) : It is not a bug in KeePassDX but a behavior of a some Android system which is known and referenced. Here: https://github.com/Kunzisoft/KeePassDX/issues/47#issuecomment-404754371 and here https://github.com/Kunzisoft/KeePassDX/issues/139#issuecomment-601116544 and here https://github.com/Kunzisoft/KeePassDX/issues/235

As you put it so well, a warning message asks the user if it is okay to use this feature when it involves risks. So if he uses it, he manually activated the feature in the settings and knowingly confirmed the risks of using it. So clearly a wish of the user. The feature is there because many people use it historically to make it easier to copy unimportant passwords and it's a legacy from KeePassDroid. Many other apps also have this copy of password in the clipboard, but without warning at all. (you should contact them all first to inform users, it's only a tip).

In addition to that, it is indicated in the wiki in informative visibility with a link present in the settings. https://github.com/Kunzisoft/KeePassDX/wiki/Clipboard

You don't even know where your problem is coming from but you are trying to find a scapegoat. In this case, do good, evidence often helps and would help solve an issue faster. We are not at all responsible for your situation and the app is created in an open way to avoid this kind of case. If you do not know how to take your responsibilities, please do not pass it on to that of others.

Again, this could be from a keylogger, your old recovered phone, a third-party app with view reading, or something else. If you are sure the problem is with KeePassDX and not from an uninformed user, please give a concrete lead so that I can make doable fixes. The code is still Open Source and will remain so, you can take your time to look at it and point out technical issues, I'll be happy to help resolve them.

J-Jamet commented 3 years ago

To speak of KeeFarce, it works with DLLs on a computer for KeePass2. This is a good way to look at security issues indeed on compouter, but I don't see how to actually use it for KeePassDX wich is on Android?

But if you find concrete vulnerabilities related to the application, do not hesitate to report them and make a pull request. It would indeed be very useful for everyone.