github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-09 11:44:41 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

Master password bypass with biometric authentication if device credentials compromised #1436

New Issue
Closed
opened 2025-11-26 22:49:03 -06:00 by GiteaMirror · 7 comments
GiteaMirror commented 2025-11-26 22:49:03 -06:00
Owner
Copy Link

Originally created by @jaywyeee on GitHub (Apr 4, 2022).

Steps To Reproduce

  1. Enable "Unlock with Biometrics"
  2. Add a new fingerprint

Expected Result

The app disallows biometric authentication and prompts the entry of the master password.

Actual Result

The app allows biometric authentication.

Screenshots or Videos

No response

Additional Context

This behavior compromises security in exchange for convenience.

If an attacker obtains the password/PIN of a device and said device is compromised, they are able to add new fingerprints/biometric data. The app currently does not disable biometric authentication when changes to biometric data are made. This allows the attacker to circumvent the master password if they have the credentials to the device itself.

Operating System

Android

Operating System Version

12

Device

Samsung

Build Version

2.17.0 (4526)

Beta

  • Using a pre-release version of the application.
Originally created by @jaywyeee on GitHub (Apr 4, 2022). ### Steps To Reproduce 1. Enable "Unlock with Biometrics" 2. Add a new fingerprint ### Expected Result The app disallows biometric authentication and prompts the entry of the master password. ### Actual Result The app allows biometric authentication. ### Screenshots or Videos _No response_ ### Additional Context This behavior compromises security in exchange for convenience. If an attacker obtains the password/PIN of a device and said device is compromised, they are able to add new fingerprints/biometric data. The app currently does not disable biometric authentication when changes to biometric data are made. This allows the attacker to circumvent the master password if they have the credentials to the device itself. ### Operating System Android ### Operating System Version 12 ### Device Samsung ### Build Version 2.17.0 (4526) ### Beta - [ ] Using a pre-release version of the application.
GiteaMirror added the bug label 2025-11-26 22:49:03 -06:00
GiteaMirror commented 2025-11-26 22:49:04 -06:00
Author
Owner
Copy Link

@tangowithfoxtrot commented on GitHub (Apr 18, 2022):

Hello, @jaywyeee.

The application temporarily disables biometric unlocking when a new fingerprint gets added to your device until you unlock your vault with your master password. When that happens, you should see a message under the password prompt stating "Biometric unlock disabled pending verification of master password". However, the application does not force a change in your vault timeout settings to force it to lock immediately.

Could you please try the following, and let me know if you're still able to use your fingerprint to unlock?

  1. Add a fingerprint to your device.
  2. Lock your Bitwarden vault.
  3. Attempt to unlock again with your fingerprint.

You should be unable to unlock without entering your master password or PIN. Upon unlocking the vault with your master password/PIN, you should be able to unlock the vault again with you biometrics.

@tangowithfoxtrot commented on GitHub (Apr 18, 2022): Hello, @jaywyeee. The application temporarily disables biometric unlocking when a new fingerprint gets added to your device until you unlock your vault with your master password. When that happens, you should see a message under the password prompt stating "Biometric unlock disabled pending verification of master password". However, the application does not force a change in your vault timeout settings to force it to lock immediately. Could you please try the following, and let me know if you're still able to use your fingerprint to unlock? 1. Add a fingerprint to your device. 2. Lock your Bitwarden vault. 3. Attempt to unlock again with your fingerprint. You should be unable to unlock without entering your master password or PIN. Upon unlocking the vault with your master password/PIN, you should be able to unlock the vault again with you biometrics.
GiteaMirror commented 2025-11-26 22:49:04 -06:00
Author
Owner
Copy Link

@jaywyeee commented on GitHub (Apr 18, 2022):

@tangowithfoxtrot I have followed the steps and the application allows me to use biometrics as normal. I have also tried the steps in the order 2, 1, 3 and it is the same.

I will clarify the steps to reproduce:

  1. Lock vault
  2. Add a new fingerprint
  3. Attempt to unlock vault

Perhaps it is a quirk with Samsung Knox?

I would provide a screen recording but everything is blacked out due to a device security policy.

@jaywyeee commented on GitHub (Apr 18, 2022): @tangowithfoxtrot I have followed the steps and the application allows me to use biometrics as normal. I have also tried the steps in the order 2, 1, 3 and it is the same. I will clarify the steps to reproduce: 1. Lock vault 2. Add a new fingerprint 3. Attempt to unlock vault Perhaps it is a quirk with Samsung Knox? I would provide a screen recording but everything is blacked out due to a device security policy.
GiteaMirror commented 2025-11-26 22:49:04 -06:00
Author
Owner
Copy Link

@mpbw2 commented on GitHub (Apr 19, 2022):

@jaywyeee Which Samsung device are you using when you experience this issue? I'm currently unable to reproduce this with the S10 running Android 12. We have some fallbacks in place for some device configurations that are unable to properly generate a key so they can continue to utilize biometrics, and it's possible your device falls into this group. We can look into making this behavior opt-in.

@mpbw2 commented on GitHub (Apr 19, 2022): @jaywyeee Which Samsung device are you using when you experience this issue? I'm currently unable to reproduce this with the S10 running Android 12. We have some fallbacks in place for some device configurations that are unable to properly generate a key so they can continue to utilize biometrics, and it's possible your device falls into this group. We can look into making this behavior opt-in.
GiteaMirror commented 2025-11-26 22:49:04 -06:00
Author
Owner
Copy Link

@jaywyeee commented on GitHub (Apr 19, 2022):

@mp-bw The device is a Samsung Galaxy Note10.

@jaywyeee commented on GitHub (Apr 19, 2022): @mp-bw The device is a Samsung Galaxy Note10.
GiteaMirror commented 2025-11-26 22:49:05 -06:00
Author
Owner
Copy Link

@mpbw2 commented on GitHub (Apr 19, 2022):

I'll add some additional diagnostic logs to our biometric service to see if we can narrow this down. Unfortunately it will take some time before that rolls out and there isn't much we can do in the meantime without potentially causing a larger problem. Leaving this issue open to revisit later.

@mpbw2 commented on GitHub (Apr 19, 2022): I'll add some additional diagnostic logs to our biometric service to see if we can narrow this down. Unfortunately it will take some time before that rolls out and there isn't much we can do in the meantime without potentially causing a larger problem. Leaving this issue open to revisit later.
GiteaMirror commented 2025-11-26 22:49:05 -06:00
Author
Owner
Copy Link

@mpbw2 commented on GitHub (Apr 22, 2022):

Note to self: logging added here

@mpbw2 commented on GitHub (Apr 22, 2022): Note to self: logging added [here](https://github.com/bitwarden/mobile/commit/ab6dde4a11889a7755be638fcb3ec224bd7d338d#diff-79d7897a7841760812c5e9bb08956f514bfc819abafcb8fd6a91fb854a3ee621)
GiteaMirror commented 2025-11-26 22:49:05 -06:00
Author
Owner
Copy Link

@jaywyeee commented on GitHub (Apr 23, 2022):

I reinstalled the application and the master password reprompt now appears properly. It's the same build so I wonder what was wrong with the previous installation. With that said, it should have been the first thing that I tried so I apologize for the unnecessary trouble.

This issue has been solved for me, so it can be safely closed, unless anyone wants to further investigate the cause. I've kept the same installation since late 2020 (without a reinstall) if that's any help.

@jaywyeee commented on GitHub (Apr 23, 2022): I reinstalled the application and the master password reprompt now appears properly. It's the same build so I wonder what was wrong with the previous installation. With that said, it should have been the first thing that I tried so I apologize for the unnecessary trouble. This issue has been solved for me, so it can be safely closed, unless anyone wants to further investigate the cause. I've kept the same installation since late 2020 (without a reinstall) if that's any help.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#1436
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?