github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-22 12:32:53 -05:00
Code Issues 144 Packages Projects Releases 118 Wiki Activity

Android unlocked without password ? #188

New Issue
Closed
opened 2025-11-07 08:30:36 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-07 08:30:36 -06:00
Owner
Copy Link

Originally created by @fcartegnie on GitHub (Jan 28, 2018).

I re-install a backup of my rom on my device, for that reason, after boot, Line wants to login.
Bitwarden shows notification, and appears as app popup after tapping the notification (maybe twice since i mess up with line).
The "popup app view" with bitwarden asks the main password,
and after tapping on that screen... the lock content appears !
I can scroll the entries and I have not typed the password yet !
I tried again right after and I was not able to reproduce.
Unfortunately I did not check that passwords were really there when clicking on entries.

  • Does bitwarden stores data in clear and only encrypt passwords ? (in that case the app just show backend without decyphering passwords)
  • Does android "popup view" has a bitmap cache (that survives reboot) and then a bug showing a previous bitwarden session ? (unlikely since i scrolled, but who knows)
Originally created by @fcartegnie on GitHub (Jan 28, 2018). I re-install a backup of my rom on my device, for that reason, after boot, Line wants to login. Bitwarden shows notification, and appears as app popup after tapping the notification (maybe twice since i mess up with line). The "popup app view" with bitwarden asks the main password, and after tapping on that screen... the lock content appears ! I can scroll the entries and I have not typed the password yet ! I tried again right after and I was not able to reproduce. Unfortunately I did not check that passwords were really there when clicking on entries. - Does bitwarden stores data in clear and only encrypt passwords ? (in that case the app just show backend without decyphering passwords) - Does android "popup view" has a bitmap cache (that survives reboot) and then a bug showing a previous bitwarden session ? (unlikely since i scrolled, but who knows)
GiteaMirror commented 2025-11-07 08:30:37 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Jan 29, 2018):

This happens because your encryption key is persisted on the device in the Android Keystore. Restoring from a backup likely restored the encryption key as well.

All data stored on the device is encrypted. We do not store plaintext data.

@kspearrin commented on GitHub (Jan 29, 2018): This happens because your encryption key is persisted on the device in the Android Keystore. Restoring from a backup likely restored the encryption key as well. All data stored on the device is encrypted. We do not store plaintext data.
GiteaMirror commented 2025-11-07 08:30:37 -06:00
Author
Owner
Copy Link

@fcartegnie commented on GitHub (Jan 30, 2018):

Unlocked again today, after reboot.
Amazon app login triggers bitwarden notification, bitwarden opens as popup.
Click outside popup and reclick on password input field.
New bitwarden notification, bitwarden opens as popup again.
Click on master password field and... opens without any input !
I have checked, and all passwords are there.

In background, 2 bitwarden app "window". Opening bitwarden solo app just never leaves the initial brand screen.

Sorry, but I don't see how, at least app unlocking, can't be a security issue.

@fcartegnie commented on GitHub (Jan 30, 2018): Unlocked again today, after reboot. Amazon app login triggers bitwarden notification, bitwarden opens as popup. Click outside popup and reclick on password input field. New bitwarden notification, bitwarden opens as popup again. Click on master password field and... opens without any input ! I have checked, and all passwords are there. In background, 2 bitwarden app "window". Opening bitwarden solo app just never leaves the initial brand screen. Sorry, but I don't see how, at least app unlocking, can't be a security issue.
GiteaMirror commented 2025-11-07 08:30:37 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Jan 30, 2018):

Yes, as mentioned previously your encryption key is persisted to the Android Keystore. A reboot does not reset this... You should probably use a stricter lock option under Settings.

@kspearrin commented on GitHub (Jan 30, 2018): Yes, as mentioned previously your encryption key is persisted to the Android Keystore. A reboot does not reset this... You should probably use a stricter lock option under Settings.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#188
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?