search

bpellin / keepassdroid

KeePass implementation for android
http://www.keepassdroid.com
Other
1.38k stars 346 forks source link

In Memory Protection Does Nothing #147

Open madphysicist opened 7 years ago

madphysicist commented 7 years ago

I have some fields that are marked for in memory protection. In the desktop version their values are replaced by asterisks. In this app, they show up in plain text.

Psykukumber commented 6 years ago

Can confirm this issue on my Android 6.0 Phone

Steps to reproduce:

  1. Open some db entry and add fild with some info
  2. Check "Protected"
  3. Tap "Save"
  4. Make sure that function is literally broken

KeePass realizations like KeePassXC stores TOTP tokens in this fields, so although I can't make screenshot, this sensitive data still visible, which I believe is a big security flaw.