Credential storage/retrieval fails (flatpak)

[jwflory]

Summary

ProtonMail Bridge v1.2.6 stuck in a login loop after prompting for 2FA key

Background

When I open ProtonMail Bridge, I go to add my account. I enter my email and password successfully. I am prompted for 2FA key. I enter 2FA key. After entering 2FA key response, I am sent back to the login screen with an error at the top:

Failure: user interaction failed

Details

Here is a screenshot of what it looks like in my GUI:

I am using a Flatpak on Linux (Fedora 32).

Outcome

Need to log in again to start bridge for my account

[jameshoulahan]

Are you able to reproduce this consistently? If so, could you try installing bridge from the official rpm package (as opposed to as a flatpak) and see if you still face the issue?

[jwflory]

@jameshoulahan: Are you able to reproduce this consistently?

Yes, on each login attempt.

I did try before when my Keyring was locked. ProtonMail Bridge prompted me to enter the keyring passphrase because it had changed. After I entered the Keyring passphrase, I hit the login loop.

@jameshoulahan: If so, could you try installing bridge from the official rpm package (as opposed to as a flatpak) and see if you still face the issue?

The RPM package does work for me. It hooks into my existing pass installation (#31) instead of trying to use my login Keyring.

[jameshoulahan]

Please note that we don't officially support the flatpak installation. But I took a look in case this was a more sinister issue which also affects our officially supported packages.

It looks to me to be an issue with the interaction between the flatpak-bridge and the system (outside the flatpak) gnome-keyring-daemon.

$ flatpak run ch.protonmail.protonmail-bridge -c --log-level trace
>>> login
... credentials ...
>>> Adding account was unsuccessful: failed to load user credentials: no credentials found for given userID

Bridge authenticates the user correctly, tries to store the credentials in the keyring, but then when trying to create the user object it cannot find the credentials in the keyring. Interesting.

Note that this is unrelated to 2FA -- the problem is reproducible on accounts without 2FA.

Also note that I cannot reproduce this with an RPM install of bridge (despite also using gnome-keyring, not pass). So this is specific to the unsupported flatpak distribution.

We certainly do wish to expand our supported distribution channels going forward and this includes investigating whether we can take advantage of the benefits flatpak offers, so chances are we will revisit this issue some time in the future. But for now I will close this issue.

[jwflory]

Please note that we don't officially support the flatpak installation. But I took a look in case this was a more sinister issue which also affects our officially supported packages.

Good to know. I didn't realize it was unofficial.

We certainly do wish to expand our supported distribution channels going forward and this includes investigating whether we can take advantage of the benefits flatpak offers, so chances are we will revisit this issue some time in the future. But for now I will close this issue.

I suspect solving #44 will also make Flatpak packaging much easier, since Red Hat is producing automation tools to take RPMs and turn them into Flatpaks.

[A6GibKm]

@jwflory I think one of the latest commits for protonmail-bridge flatpak fixes this issue. I haven't had feedback on this besides that it works on my machine™, I would appreciate if you tell me if it is indeed working.

[jwflory]

@A6GibKm Thanks for following up. I currently use the RPM package on my Fedora 32 desktop, but I know other users using the Flatpak on RHEL 8. I'll try to make time to re-test the Flatpak again.