limpkin / mooltipass

Github repository dedicated to the mooltipass project
https://www.themooltipass.com
521 stars 113 forks source link

Memory Management mode is very confusing #200

Open NicoHood opened 8 years ago

NicoHood commented 8 years ago

I was trapped again of the memory management mode. There are several issues:

limpkin commented 8 years ago

written in our todo list.

NicoHood commented 8 years ago

More details of some of the critical bugs:

#1
Enter memory management mode
add a password (password1)
klick safe
deny on the device to update the (new) password
reenter memory management mode
the password is still there, but it is not on the device!

#2
Open memory management mode
add a new password (password2)
wait until the lock times out (3 minutes for me)
klick safe
it will fail
if you enter memory management again the bug above will (still) show up, and will be triggered twice.
So in the end you have 2x password1 and 1x password 2, all of them unsafed and not on the device.
All other entries will also be duplicated! I am afraid to safe those. You need to restart the app.
No "unsafed changes" warning will appear though
it will still fail if you unlock the device before you click safe. so there is at least a bug in the app, while the firmware also should not just leave memory management mode.

# possible solutions:
when entering memory management the list should be cleared, so no old entries will be there. or for better security when you leave it.
when safing the app should check if the device is locked and then needs to add a warning again when safing.
the firmware should not lock when in memory management mode, the display may go off though.