subdavis / Tusk

🐘 🔒 KeePass-compatible browser extension for filling passwords.
https://subdavis.com/Tusk
Other
476 stars 73 forks source link

Not able to use keyfile after enabling it on keepass db #242

Closed fvzwieten closed 5 years ago

fvzwieten commented 5 years ago

This issue is a bug

  1. Have an existing keepass db with password only
  2. Set up tusk to access it with password only
  3. Change keepass DB to password PLUS keyfile
  4. Change tusk to add same keyfile
  5. Lock tusk
  6. Unlock DB using Tusk with password AND keyfile

result: Error InvalidKey: invalid key

  1. Unlock DB using Tusk with password ONLY

result: still works!!!!

What is the expected behaviour

Successfull opening of the DB

Additional remarks

It seems tusk is making a private full copy of the DB. This would also explain that tusk does not pick up any new entries added using keepassXC until after the browser is restarted (which if never in my case)

Environment

Operating System: Fedora 28

Browser: Firefox 62

Storage: Nextcloud 14

subdavis commented 5 years ago

It seems tusk is making a private full copy of the DB. This would also explain that tusk does not pick up any new entries added using keepassXC until after the browser is restarted (which if never in my case)

screenshot_20180922_090127

This isn't something you had to "figure out". It's clearly stated when you enable the filesystem provider. It isn't possible for a browser extension to access disk on its own -- there has to be a user interaction to pick the file. Its a security thing. This isn't fixable.

fvzwieten commented 5 years ago

Right! I interpreted that sentence differently. Sorry for the noise. I now use the Shared link option and it works as expected. I use the local file option as a fallback when the url is unreachable somehow.

subdavis commented 5 years ago

Ah, got it! You won't have to do that anymore after #220 gets fixed.

I'm also going to improve the error message because I think this confuses a lot of people. I agree the verbiage could be better. Thanks!