github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-15 06:59:05 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

Android - auto lock doesn't always lock #260

New Issue
Closed
opened 2025-11-07 08:33:19 -06:00 by GiteaMirror · 7 comments
GiteaMirror commented 2025-11-07 08:33:19 -06:00
Owner
Copy Link

Originally created by @balazer on GitHub (Aug 13, 2018).

Android Bitwarden app version 1.18.0 (1493):

I have Lock Options set to 1 minute, and Unlock with PIN Code enabled. I launch Bitwarden, unlock with my PIN, and I'm presented with the Bitwarden main screen showing My Vault. I lock my phone's screen by pressing the power button. I wait more than one minute, and then unlock my phone's screen with the power button. Bitwarden is then right there on my screen, showing My Vault. All of my passwords are accessible. It doesn't ask for my PIN again. I can reproduce this consistently, even waiting much longer than 1 minute.

Also, sometimes Bitwarden fails to ask for my PIN after I switch away from the Bitwarden app by pressing the home button, and then switch back to Bitwarden more than a minute later using Android's Recents screen. Reproducing this way is inconsistent.

I had assumed the lock timeout would be based on the time since the last user interaction or time since the app was last in the foreground. Neither seems to be the case. I think the lock timeout should be as strict as possible, which probably means time since last user interaction. Certainly I expect that if I lock my phone screen and walk away, no one should be able to pick up my phone minutes later and access my vault without entering my PIN.

This problem is not reproducible when Lock Options is set to Immediately. Set that way, the app asks for my PIN every time after switching back to Bitwarden after switching away from the app or locking my phone's screen.

The issue is reproducible in stock Android 7.1.1 on the Nexus 9, and in an AOSP 6.0.1 variant called AOKP.

Originally created by @balazer on GitHub (Aug 13, 2018). Android Bitwarden app version 1.18.0 (1493): I have Lock Options set to 1 minute, and Unlock with PIN Code enabled. I launch Bitwarden, unlock with my PIN, and I'm presented with the Bitwarden main screen showing My Vault. I lock my phone's screen by pressing the power button. I wait more than one minute, and then unlock my phone's screen with the power button. Bitwarden is then right there on my screen, showing My Vault. All of my passwords are accessible. It doesn't ask for my PIN again. I can reproduce this consistently, even waiting much longer than 1 minute. Also, sometimes Bitwarden fails to ask for my PIN after I switch away from the Bitwarden app by pressing the home button, and then switch back to Bitwarden more than a minute later using Android's Recents screen. Reproducing this way is inconsistent. I had assumed the lock timeout would be based on the time since the last user interaction or time since the app was last in the foreground. Neither seems to be the case. I think the lock timeout should be as strict as possible, which probably means time since last user interaction. Certainly I expect that if I lock my phone screen and walk away, no one should be able to pick up my phone minutes later and access my vault without entering my PIN. This problem is not reproducible when Lock Options is set to Immediately. Set that way, the app asks for my PIN every time after switching back to Bitwarden after switching away from the app or locking my phone's screen. The issue is reproducible in stock Android 7.1.1 on the Nexus 9, and in an AOSP 6.0.1 variant called AOKP.
GiteaMirror added the bug label 2025-11-07 08:33:19 -06:00
GiteaMirror commented 2025-11-07 08:33:20 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Aug 13, 2018):

I've been testing this today on a Nexus 5X on Android 8 and have not been able to reproduce it.

@kspearrin commented on GitHub (Aug 13, 2018): I've been testing this today on a Nexus 5X on Android 8 and have not been able to reproduce it.
GiteaMirror commented 2025-11-07 08:33:20 -06:00
Author
Owner
Copy Link

@balazer commented on GitHub (Aug 13, 2018):

I'll see if I can get my hands on an Android 8 device to do more testing.

Let me know if I can get you anything useful like logcats or a copy of the app's data. I don't have any sensitive data in my vault yet.

@balazer commented on GitHub (Aug 13, 2018): I'll see if I can get my hands on an Android 8 device to do more testing. Let me know if I can get you anything useful like logcats or a copy of the app's data. I don't have any sensitive data in my vault yet.
GiteaMirror commented 2025-11-07 08:33:20 -06:00
Author
Owner
Copy Link

@balazer commented on GitHub (Aug 14, 2018):

I just tested on stock Android 8.1.0 on the Nexus 6P with the same results.

Steps to reproduce:

  1. Install Bitwarden 1.18.0 (1493) from Play Store and log into Bitwarden
  2. Go to Settings and set Lock Options to 1 minute
  3. Set "Unlock with PIN Code" and enter a PIN
  4. Back out of the app
  5. Launch the app. It asks for my PIN and then takes me to My Vault
  6. Press the power button to lock the screen
  7. Wait 70 seconds
  8. Press the power button and swipe to unlock the screen. It shows My Vault without asking for a PIN.

I made additional tests starting from step 6. I tested periods of 70 seconds about 6 times, and every time it failed to ask for my PIN. I did two tests of two minutes each, and it asked for my PIN in one of those tests. Same for 3 minutes. I did one test of 4 minutes 40 seconds, and it didn't ask for my PIN. That was my longest test on this phone.

On my Android 6.0.1 phone, I first noticed the problem when I had Lock Options set to 15 minutes and it didn't ask for my PIN after I hadn't used my phone for approximately 45 minutes.

@balazer commented on GitHub (Aug 14, 2018): I just tested on stock Android 8.1.0 on the Nexus 6P with the same results. Steps to reproduce: 1. Install Bitwarden 1.18.0 (1493) from Play Store and log into Bitwarden 2. Go to Settings and set Lock Options to 1 minute 3. Set "Unlock with PIN Code" and enter a PIN 4. Back out of the app 5. Launch the app. It asks for my PIN and then takes me to My Vault 6. Press the power button to lock the screen 7. Wait 70 seconds 8. Press the power button and swipe to unlock the screen. It shows My Vault without asking for a PIN. I made additional tests starting from step 6. I tested periods of 70 seconds about 6 times, and every time it failed to ask for my PIN. I did two tests of two minutes each, and it asked for my PIN in one of those tests. Same for 3 minutes. I did one test of 4 minutes 40 seconds, and it didn't ask for my PIN. That was my longest test on this phone. On my Android 6.0.1 phone, I first noticed the problem when I had Lock Options set to 15 minutes and it didn't ask for my PIN after I hadn't used my phone for approximately 45 minutes.
GiteaMirror commented 2025-11-07 08:33:20 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Aug 14, 2018):

These are basically the same steps I am taking and I haven't been able to reproduce it. Weird.

In the meantime, I would suggest that you keep your device properly secured with locking from the OS. Locking from the Bitwarden app has not been proven to be a secure means of preventing access to the vault (as we can see here).

@kspearrin commented on GitHub (Aug 14, 2018): These are basically the same steps I am taking and I haven't been able to reproduce it. Weird. In the meantime, I would suggest that you keep your device properly secured with locking from the OS. Locking from the Bitwarden app has not been proven to be a secure means of preventing access to the vault (as we can see here).
GiteaMirror commented 2025-11-07 08:33:20 -06:00
Author
Owner
Copy Link

@RePacked commented on GitHub (Aug 27, 2018):

I am able to reproduce this on my Nexus 5X running on LineageOS 15.1, Android 8.1.0

@RePacked commented on GitHub (Aug 27, 2018): I am able to reproduce this on my Nexus 5X running on LineageOS 15.1, Android 8.1.0
GiteaMirror commented 2025-11-07 08:33:21 -06:00
Author
Owner
Copy Link

@gcvl commented on GitHub (Jun 2, 2019):

Hi,
I'm getting this on my Nokia 8, Android Pie, Bitwarden 1.22 (1652).
The background block triggers only if I keep the screen active, while doing other things before the set time runs out.

Example: I set 1 minute, then quit and open some other stuff, come back after two minutes ---> The PIN is requested.
I set 1 minute, then quit and lock the screen, unlock the screen, open Bitwarden ---> It gives access to all my passwords without PIN.

Oddly, this is NOT happening if I choose the fingerprint unlock.
EDIT: I was wrong, it happens randomly with fingerprint lock too. It's just not apparently a reliable function, unless you set the timeout to "Immediately".

@gcvl commented on GitHub (Jun 2, 2019): Hi, I'm getting this on my Nokia 8, Android Pie, Bitwarden 1.22 (1652). The background block triggers only if I keep the screen active, while doing other things before the set time runs out. Example: I set 1 minute, then quit and open some other stuff, come back after two minutes ---> The PIN is requested. I set 1 minute, then quit and lock the screen, unlock the screen, open Bitwarden ---> It gives access to all my passwords without PIN. Oddly, this is NOT happening if I choose the fingerprint unlock. EDIT: I was wrong, it happens randomly with fingerprint lock too. It's just not apparently a reliable function, unless you set the timeout to "Immediately".
GiteaMirror commented 2025-11-07 08:33:21 -06:00
Author
Owner
Copy Link

@gcvl commented on GitHub (Jun 14, 2019):

Seems fixed here in 2.0.3 (1914)!

@gcvl commented on GitHub (Jun 14, 2019): Seems fixed here in 2.0.3 (1914)!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#260
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?