google / google-authenticator-android

Open source fork of the Google Authenticator Android app
https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2
Apache License 2.0
1.58k stars 470 forks source link

Issue VACCUM SQL directive to prevent the DB from keeping old Seeds. #89

Closed pfedan closed 5 years ago

googlebot commented 5 years ago

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

:memo: Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here (e.g. I signed it!) and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers

ℹ️ Googlers: Go here for more info.

pfedan commented 5 years ago

I signed it!

googlebot commented 5 years ago

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

pfedan commented 5 years ago

I'd consider this also a security issue (and if not, at least a matter of 'tidiness') to securely delete the seeds, see also the documentation of VACUUM (third bullet in the top list).

ThomasHabets commented 5 years ago

Is that semicolon needed? The other instances of mDatabase.execSQL don't end in semicolon.

ThomasHabets commented 5 years ago

I've filed this internally as b/129332125 because…

--

FYI: The version in Google Play Store / Apple App store is not the same as this opensource version. They've diverged. This opensource version is also unlikely to end up in the app stores. This open source version doesn't get much love, but I'll accept well-written pull requests. But don't expect this feature to be implemented by Google.

ThomasHabets commented 5 years ago

(will merge this anyway after you confirm the semicolon thingy)

pfedan commented 5 years ago

The semicolon is actually optional, as it is only one single command in the statement. It'll work either way. It was just a matter of habit to finalize an SQL command using ;.

I've filed this internally as b/129332125 because…

Not sure what that means. Will that change also be made in the Play Store / App Store versions?

ThomasHabets commented 5 years ago

Either is good. Thanks!