search

Nitrokey / nitrokey-app

Nitrokey's Application (Win, Linux, Mac)
https://www.nitrokey.com/
287 stars 55 forks source link

Doubled OTP entries #403

Closed techge closed 5 years ago

techge commented 5 years ago

I thought that this problem is already known and thus never reported. As an user told me about it I looked closer and realized that it isn't reported yet.

I regularly, but not reproducibly get my OTP entries doubled in the password menu as seen below:

screenshot_20190125_102330

This happens quite often, but not always. I could not deliberatly create I device which does the same, so that it is unclear when and why this will happen. At least, I have a test device for future changes :wink:

I have three OTP entries and three PWS entries. After unlocking the PWS the doubled OTPs are replaced by the passwords from the PWS. Even unplugging and replugging seems to solve this sometimes. In general it is just difficult to get a clou what happens here.

Storage firmware: 0.48 Nitrokey App: 1.3.2 (Arch Linux Official Repo) <- did happen for previous versions too.

The user I talked about has doubled entries in the following scheme:

So differently than mine. I think his doubling is PWS entries only. I already asked him for more information.

I used my private GitHub account because this happens with my private device only so far. @alex-nitrokey for future talk about it

@szszszsz Would providing a log here leak personal/identifying data? I should know this already, sorry...

techge commented 5 years ago

I'd like to add: All entries are working correctly (so a doubled entry points to the correct slot on the device)

techge commented 5 years ago

Playing around a bit more... Did I say I could not reproduce? I could!

screenshot_20190125_110536

Because I thought it might have to do with having the same amount of PWS entries: no, this happens with three and two PWS as I could test (now that I have a test device which does not contain valuable data :smile:)

This one is Nitrokey Storage firmware 0.53. No "luck" with Pro so far.

techge commented 5 years ago 
$ nitrokey-app --df out.log --dl 4 --debug
("nitrokey-app", "--df", "out.log", "--dl", "4", "--debug")
Language saved in settings:  "en" "/home/ace/.config/Nitrokey/Nitrokey App.conf"                                                                      
QLocale(English, Latin, United States) "English" "en_US"
Loading translation files
":/i18n/nitrokey_en.qm"  - file loaded successfully:  true , file exists on disk:  true                                                               
Nitrokey App Release 1.3.2 (git: )
Application started successfully.
[Fri Jan 25 11:12:29 2019][DEBUG_L2]    run
[Fri Jan 25 11:12:29 2019][DEBUG_L1]    Throw: Device not initialized
[Fri Jan 25 11:12:29 2019][DEBUG_L2]    run
[Fri Jan 25 11:12:29 2019][DEBUG_L1]    Throw: Device not initialized
[Fri Jan 25 11:12:29 2019][DEBUG_L2]    run
[Fri Jan 25 11:12:29 2019][DEBUG_L1]    Throw: Device not initialized
[Fri Jan 25 11:12:29 2019][DEBUG_L2]    run
[Fri Jan 25 11:12:29 2019][DEBUG_L1]    Throw: Device not initialized
[Fri Jan 25 11:12:29 2019][DEBUG_L2]    run
[Fri Jan 25 11:12:29 2019][DEBUG_L1]    Throw: Device not initialized
on_DeviceConnected

out.log

szszszsz commented 5 years ago

Confirmed. I have seen that as well earlier, but similarly thought this is already reported. Regarding the log, the secrets and slot names are removed in the default build, but the data are not anonimized - e.g. the chip id is in the log.

Marking to be fixed in the next release.

alex-nitrokey commented 5 years ago

The user I talked about could ony confirm doubled OTP entries so far.