search

nextcloud / passman-webextension

Webextension for the Passman Nextcloud app. Also offers browser extension & Android app.
https://passman.cc
GNU Affero General Public License v3.0
113 stars 43 forks source link

[SECURITY] Master Password does not work until browser restart #321

Open shinenelson opened 4 years ago

shinenelson commented 4 years ago
### Steps to reproduce 1. Install the Extension 2. Login to Passman vault 3. Set a Master Password ( do NOT remember it locally; what's the point of a password manager if the master key is stored unencrypted on the local file system? ) -> Do NOT restart the browser 4. Click the lock icon to lock the extension 5. Click 'Unlock' button 6. Search for saved password from vault ### Expected behaviour

The extension should report an error ( #320 ) and not unlock the vault.

Actual behaviour

Due to #320 and probably because the password vault was just unsealed during setup, it is still accessible. And unlike in #320, the extension is active and triggered on website form fields. However, they don't autofill into the form fields, unlike when in properly unsealed mode, the fields are automatically filled in. All passwords is directly accessible and viewable ( at least ) from the extension though.

Screenshots Search in locked state ![Screenshot from 2020-03-24 05-09-42](https://user-images.githubusercontent.com/4771718/77376311-1dc20d00-6d96-11ea-8a98-d7a9de78665d.png) Triggering on websites ![Screenshot_2020-03-24 Client Area](https://user-images.githubusercontent.com/4771718/77376187-b310d180-6d95-11ea-9433-548e0763b55e.png)

Configuration

Operating system: Ubuntu 18.04.4 LTS

Browser: Firefox 75.0

Extensions that might cause interference: Nextcloud Passwords, LessPass

Passman version: 2.3.5

Extension version: 2.1.1

Nextcloud version: 18.0.0

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/90854578-security-master-password-does-not-work-until-browser-restart?utm_campaign=plugin&utm_content=tracker%2F52236699&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F52236699&utm_medium=issues&utm_source=github).