keepassium / KeePassium

KeePass-compatible password manager for iOS
https://keepassium.com
Other
1.21k stars 103 forks source link

App screen is not reliably hidden in app switcher #330

Closed bob-lobster closed 11 months ago

bob-lobster commented 1 year ago

Description Closing the app will sometimes, especially when closing the app right after unlocking through FaceID, not show the splash in the app switcher, possibly leaking database details including shown passwords. Instead the last seen view will show and can then be seen in the app switcher.

How to reproduce Steps to reproduce the behavior:

  1. Open app
  2. Close app immediately after FaceID prompt
  3. Open app switcher
  4. See last view of app instead of splash screen

Expected behavior Only the splash screen is shown in the switcher, hiding any app details.

Screenshots IMG_2808

Environment:

keepassium commented 1 year ago

Thank you for the feedback!

Closing the app will sometimes, especially when closing the app right after unlocking through FaceID, not show the splash

Just to be sure: is it "especially" or "only"?

I can confirm the "only" case: if the app is minimized during Face ID animation, the UI might appear uncovered. This is due to a technical challenge:

But as a side effect, if you minimize the app during Face ID animation, the app switcher screenshot might indeed catch the app unlocked after the Face ID delay. The best solution I can offer at the moment is to avoid minimizing the app during Face ID animation... (aka "just avoid holding it in that way".)

Have you noticed other scenarios where the issue occurs?

keepassium commented 11 months ago

@bob-lobster , any feedback on the questions above?

bob-lobster commented 11 months ago

Thanks for your reply and sorry for not getting back directly.

I indeed can‘t replicate it in any other scenario.

I have tried replicating it in other apps though.

In my banking app it never happens. In Microsoft Authenticator it is harder to replicate but can happen with the right timing.

Since it is a niche scenario I agree it can be worked around.

keepassium commented 11 months ago

Thank you for the update. In this case I will close this as a known limitation.