beemdevelopment / Aegis

A free, secure and open source app for Android to manage your 2-step verification tokens.
https://getaegis.app
GNU General Public License v3.0
8.37k stars 355 forks source link

Allow previewing of encrypted backup contents when importing into Aegis #1311

Open elliotwutingfeng opened 3 months ago

elliotwutingfeng commented 3 months ago

Problem

Whenever I export an encrypted backup from Aegis, I want to ensure that the backup contents are exported correctly, that the ciphertext is not gibberish due to implementation errors. Currently we can verify the integrity of encrypted Aegis backup files by attempting to re-import them into Aegis.

Current situation

When re-importing an encrypted backup, an "Import entries" section for handling "potential duplicates" appears. This list contains all the entries to be imported, and the user can uncheck specific entries they do not want to import.

This "Import entries" section is not detailed enough, as it only shows the issuer and the label of each entry, but not other essential details like its secret key, icon, digits etc. It is unsafe to assume that the secret key in particular is correct, given that the issuer and the label are correct.

The only way to verify that the entry contains the all the correct information is to proceed with the import and view its details via the "Edit Entry" menu.

This would be tedious as I would have to enter the "Edit Entry" menu for each entry, one-by-one, and then manually delete the duplicate entries afterwards.

Workarounds

We can transfer the encrypted backup onto a computer and use a python script like this https://github.com/beemdevelopment/Aegis/blob/master/docs/decrypt.py to verify the contents. But not all Aegis users are capable of running Python scripts.

Solution

Allow users to view all entry details in the "Import entries" section, maybe even show the generated OTP code in real-time.