search

mozilla-lockwise / lockwise-ios

Firefox's Lockwise app for iOS
https://mozilla-lockwise.github.io/lockwise-ios/
Mozilla Public License 2.0
244 stars 46 forks source link

FEATURE REQUEST: Ask to unlock every time when switching the app/when revealing passwords. #1105

Open jdhauck opened 4 years ago

jdhauck commented 4 years ago

Why/User Benefit/User Problem

Enhanced security when leaving the app open.

What/Requirements

After I have opened Lockwise on my phone and authenticated (Fingerprint/FaceID/Passcode) once, then I can reveal passwords (tapping on the eye) without authenticating again, even if I have in between switched to other apps.

It would be great if we were able to control this behavior in the settings/preferences through two options:

(1) Have Lockwise lock not only when closing the app but also when navigating away from it but leaving it open. I.e., an option to have Lockwise ask me for authentication every time I switch to the app (even if it was already open). (2) It would furthermore be great if we could set Lockwise to always ask for authentication before revealing a password when clicking on the eye icon (independent of 1).

Point (1) is the default behavior (or at least there's a setting to make it the default) in all banking apps, but also some email apps, such as protonmail ask for authentication every time. Lockwise should also have that level of security.

Point (2) is already possible in the Firefox browser integrated desktop version of Lockwise, where I can have it ask me for the Master password every time I want to reveal a password.

GrizzlyAK commented 4 years ago

This feature is a requirement before I will use Lockwise on iOS. Lockwise on mobile should not become a hole in Lockwise's security that is built into the desktop version.

OddHouseGames commented 4 years ago

Yes, why is option to instant lock, missing from options menu? This seems like a huge flaw.

On the settings page there is a menu option to ‘lock now’

If we can can’t have instant lock, can you at least add a lock icon on the main page UI or something similar so that we can more easily ‘lock now’ without having to go into settings menu.

GrizzlyAK commented 4 years ago

After some testing, I’ve finally decided to give up on Lockwise as a password vault solution, and cleared all my Firefox passwords (Secured via the Master Password function, and manually copied around to various desktops and laptops - since I never synced passwords).

I am now using Bitwarden as my password vault across all apps and devices, as it has the functionality I desire. A Firefox only Vault no longer served my needs, and I needed secure access to passwords, documents, and notes beyond my browser, and especially on my mobile devices. It also has the feature being requested here, where you can use your TouchID or a numeric code to unlock your vault after leaving it, or after a certain period of time, based on user settings. You can also determine whether you’ll require the full password or just the fingerprint or numeric code when launching the app. All good options. It also syncs between all your devices: mobile, desktop, and even the Firefox browser add-on. It was the best solution I’ve found, for anyone else looking for an alternative.

ivanjonas commented 4 years ago

Came here from this review hoping for progress, but I see none. I'm afraid that despite being a huge Mozilla fan, I will have to switch away from using this tool.

It's rather ironic that Lockwise does not lock 🤔

guithib commented 4 years ago

I am also coming from Joe Kreydt's Medium post. Does anyone have some news about this lockdown feature?

omniproc commented 4 years ago

This feature is a requirement before I will use Lockwise on iOS. Lockwise on mobile should not become a hole in Lockwise's security that is built into the desktop version.

Even more: there should be no obvious built in security hole in a password manager. If a 12 year old with access to a device I use is able to access my passwords, that's probably not the password manager I want to use.

jdhauck commented 3 years ago

It's been 9 months since I opened this issue.
Is there any developer out there who would be able to comment on what the status of it is?

ivanjonas commented 3 years ago

I've given up on waiting for this. The last commit was over a month ago, and it was a single line addressing spacing in the UI. https://github.com/mozilla-lockwise/lockwise-ios/commit/f0de1ad8a71d0a67c5b0a841f0605463cd89bb7d

I'm using 1password now. It has very few, and very minor, annoyances. Otherwise it's great.

danielschranz commented 3 years ago

I just installed the app to find out if I trust it enough over my current setup using Keypass and manually syncing between devices.

And I agree this would be a nice feature but seeing that I can set a timeout of 1min after which the app is locked again I don't think this is a high priority issue for me (and probably not the devs either) am I missing something when I think that is a good enough solution for now?

jdhauck commented 3 years ago

Hi @st3fan, is there a particular reason this has been closed? I don't see it's been implemented, or is it in the pipeline for the next version? Would be amazing :)