search

keepassxreboot / keepassxc

KeePassXC is a cross-platform community-driven port of the Windows application “Keepass Password Safe”.
https://keepassxc.org/
Other
21.3k stars 1.47k forks source link

[FdoSecrets] Serialize auth requests from the same client #8084

Open Aetf opened 2 years ago

Aetf commented 2 years ago

Summary

From the discussion https://github.com/keepassxreboot/keepassxc/discussions/8082#discussion-4092557 and https://github.com/keepassxreboot/keepassxc/discussions/8082#discussioncomment-2803635.

Do not show auth prompts for the same client at the same time in parallel. Show them one by one, so that if the user select "allow for all", later ones can be automatically answered.

One step further is to add a timer with a small timeout per client before showing the first auth prompt, in the hope that the client is likely to request many secrets in a short time, and some timeout can be used to aggregate all requests in a single prompt.

Aetf commented 2 years ago

Another dimension is to serialize requests to the same database. In combination with per application serialization, at most #database dialogs will be shown.

mgorny commented 1 year ago

I'm also facing this problem with Evolution — I suspect that this may be the mail client OP is talking about. What's even worse, if you don't answer these prompts fast enough, Evolution timeouts and seems to remove some internal bit saying that the OAuth session key is in secrets db, effectively forcing to me sign in to all accounts again.