github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-09 03:33:36 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

Using PIN only will save master password in persistent memory in Android? #1102

New Issue
Closed
opened 2025-11-26 22:39:09 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-26 22:39:09 -06:00
Owner
Copy Link

Originally created by @kvngvikram on GitHub (Sep 20, 2020).

Describe the Bug

When i enable unlocking app using PIN, there will be a prompt asking if i want to re enter master password for a unlocking after app restart. I selected NO. Now Bitwarden never asks for master password after app restart or even after complete phone reboot. So is the master password stored somehow in persistent storage? The only security now is just a PIN. Someone can clone the hard drive and brute force the PIN. They can use a fresh clones after every 5 or so attempts.

I don’t have much knowledge on how things work, i came here after reading this thread.

There is no such necessity for any changes, but it should be mentioned if there are any problems

Steps To Reproduce

After a fresh install in android, after logging in

  1. Go to settings
  2. Click on ‘Unlock with PIN Code’ to enable it
  3. Enter a new PIN code and submit
  4. Click on 'no’ in the prompt asking if master password is required on app restart

Expected Result

i use PIN and select no or any new option. Then it should be enough to enter master password once after fresh phone reboot and pin after that. I am assuming that unlocked vault always stays in RAM and master password stays in RAM as well. Once phone is switched off or rebooted, RAM should be erased.

Actual Result

PIN is enough to unlock after app restart or phone reboot.

Environment

  • Device: Redmi 6A
  • MIUI version: MIUI Global 11.0.8 | Stable 11.0.8.0(PCBMIXM)
  • Android version: 9 PPR1.180610.011
  • Build Version: 2.6.0 (3162)
  • Is this a Beta release? Downloaded from play store, so maybe no
.
Originally created by @kvngvikram on GitHub (Sep 20, 2020). <!-- Comment: Please do not submit feature requests. The [Community Forums][1] has a section for submitting, voting for, and discussing product feature requests. [1]: https://community.bitwarden.com --> ## Describe the Bug When i enable unlocking app using PIN, there will be a prompt asking if i want to re enter master password for a unlocking after app restart. I selected NO. Now Bitwarden never asks for master password after app restart or even after complete phone reboot. So is the master password stored somehow in persistent storage? The only security now is just a PIN. Someone can clone the hard drive and brute force the PIN. They can use a fresh clones after every 5 or so attempts. I don’t have much knowledge on how things work, i came here after reading this [thread](https://www.reddit.com/r/Bitwarden/comments/i7243i/bitwarden_vault_protection_in_android/g0ziebk/?utm_source=share&utm_medium=ios_app&utm_name=iossmf&context=3). There is no such necessity for any changes, but it should be mentioned if there are any problems <!-- Comment: A clear and concise description of what the bug is. --> ## Steps To Reproduce <!-- Comment: How can we reproduce the behavior: --> After a fresh install in android, after logging in 1. Go to settings 2. Click on ‘Unlock with PIN Code’ to enable it 3. Enter a new PIN code and submit 4. Click on 'no’ in the prompt asking if master password is required on app restart ## Expected Result <!-- Comment: A clear and concise description of what you expected to happen. --> i use PIN and select no or any new option. Then it should be enough to enter master password once after fresh phone reboot and pin after that. I am assuming that unlocked vault always stays in RAM and master password stays in RAM as well. Once phone is switched off or rebooted, RAM should be erased. ## Actual Result <!-- Comment: A clear and concise description of what is happening. --> PIN is enough to unlock after app restart or phone reboot. <!-- Comment: If applicable, add screenshots and/or a short video to help explain your problem. --> ## Environment - Device: Redmi 6A - MIUI version: MIUI Global 11.0.8 | Stable 11.0.8.0(PCBMIXM) - Android version: 9 PPR1.180610.011 - Build Version: 2.6.0 (3162) - Is this a Beta release? Downloaded from play store, so maybe no <!-- Comment: Add any other context about the problem here. -->.
GiteaMirror commented 2025-11-26 22:39:09 -06:00
Author
Owner
Copy Link

@tgreer-bw commented on GitHub (Sep 21, 2020):

Your PIN is actually performing encryption/decryption functions, your master password/master key is safe. Also, if you enter your PIN wrong 5 times it will kick you back to your Master Password entry.

@tgreer-bw commented on GitHub (Sep 21, 2020): Your PIN is actually performing encryption/decryption functions, your master password/master key is safe. Also, if you enter your PIN wrong 5 times it will kick you back to your Master Password entry.
GiteaMirror commented 2025-11-26 22:39:10 -06:00
Author
Owner
Copy Link

@kvngvikram commented on GitHub (Sep 21, 2020):

Someone can clone the hard drive and brute force the PIN. They can use a fresh clones after every 5 or so attempts.

If I am expecting someone to do this then I should not use a PIN?
Note that once hard drive is cloned the 5 attempts are useless, after 5 attempts a fresh clone can be used.

@kvngvikram commented on GitHub (Sep 21, 2020): > Someone can clone the hard drive and brute force the PIN. They can use a fresh clones after every 5 or so attempts. If I am expecting someone to do this then I should not use a PIN? Note that once hard drive is cloned the 5 attempts are useless, after 5 attempts a fresh clone can be used.
GiteaMirror commented 2025-11-26 22:39:10 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Sep 21, 2020):

@kvngvikram Then you should not use the PIN option that doesn't require the master password on application restart. There are two options when enabling PIN.

@kspearrin commented on GitHub (Sep 21, 2020): @kvngvikram Then you should not use the PIN option that doesn't require the master password on application restart. There are two options when enabling PIN.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#1102
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?