helloworld1 / FreeOTPPlus

Enhanced fork of FreeOTP-Android providing a feature-rich 2FA authenticator
Apache License 2.0
654 stars 75 forks source link

Security problem with screenshots #281

Open trikaphundo opened 1 month ago

trikaphundo commented 1 month ago

The problem

The application does not allow screenshots on the main activity, the activity listing all the entries for which you have OTP setup. But screenshots can be taken in editing activities, where all the sensitive information of entries is displayed.

Steps to reproduce the problem

  1. Open FreeOTP+.
  2. Try to take a screenshot (Android will prevent it).
  3. Select an entry and edit it: entry -> Edit.
  4. Try to take a screenshot (Android will not prevent it).

Other related issues

The problem here is, not only the possibility to take screenshots, but the information that is displayed in the activity: secret should not be visible at all! Related to issues #162 #181