Android Accessibility Service #372

GiteaMirror commented

@callaars commented on GitHub (Oct 12, 2016):

Can we have this optional please, I personally don't like it auto-auto-filled.

@callaars commented on GitHub (Oct 12, 2016): Can we have this optional please, I personally don't like it auto-auto-filled.

GiteaMirror commented

@kspearrin commented on GitHub (Oct 12, 2016):

@bcallaars It would be optional since you have to manually enable the accessibility service in settings.

@kspearrin commented on GitHub (Oct 12, 2016): @bcallaars It would be optional since you have to manually enable the accessibility service in settings.

GiteaMirror commented

@grubernaut commented on GitHub (Nov 3, 2016):

This would be amazingly helpful if it didn't require a secondary keyboard to switch to, like 1Password requires.

@grubernaut commented on GitHub (Nov 3, 2016): This would be amazingly helpful if it didn't require a secondary keyboard to switch to, like 1Password requires.

GiteaMirror commented

@kspearrin commented on GitHub (Dec 17, 2016):

I am doing some research on this issue and am looking at the Keepass2Android implementation. I see that it uses system notifications to give me the ability to copy the username/password to clipboard whenever it detects a password field on screen, but I do not see where it pops up an overlay that lists my logins to pick from and actually autofill. Am I missing something? Anyone familiar with the Keepass2Android app?

@kspearrin commented on GitHub (Dec 17, 2016): I am doing some research on this issue and am looking at the Keepass2Android implementation. I see that it uses system notifications to give me the ability to copy the username/password to clipboard whenever it detects a password field on screen, but I do not see where it pops up an overlay that lists my logins to pick from and actually autofill. Am I missing something? Anyone familiar with the Keepass2Android app?

GiteaMirror commented

@mrchecky commented on GitHub (Jan 21, 2017):

Any updates on time frame for this feature? Deal breaker for me until it's implemented. Hope to see it soon. Thanks

@mrchecky commented on GitHub (Jan 21, 2017): Any updates on time frame for this feature? Deal breaker for me until it's implemented. Hope to see it soon. Thanks

GiteaMirror commented

@kspearrin commented on GitHub (Jan 21, 2017):

See my last comment. I am still looking for examples of a good implementation (other than LastPass). Some of the work has already been started.

@kspearrin commented on GitHub (Jan 21, 2017): See my last comment. I am still looking for examples of a good implementation (other than LastPass). Some of the work has already been started.

GiteaMirror commented

@CGrandez commented on GitHub (Jan 28, 2017):

Try the (sticky password) application. It has a floating option that allows you to choose between your accounts.

@CGrandez commented on GitHub (Jan 28, 2017): Try the (sticky password) application. It has a floating option that allows you to choose between your accounts.

GiteaMirror commented

@CGrandez commented on GitHub (Jan 28, 2017):

Another good application is (Dashlane Password Manager)

@CGrandez commented on GitHub (Jan 28, 2017): Another good application is (Dashlane Password Manager)

GiteaMirror commented

@kspearrin commented on GitHub (Feb 1, 2017):

I have autofill working well in the following browsers:

Chrome
Android
Brave
Opera

If anyone is interested in helping beta testing the next release of the mobile app with the autofill service, let me know. You can email me on the website using the contact form or join our gitter chatroom here: https://gitter.im/bitwarden/Lobby

@kspearrin commented on GitHub (Feb 1, 2017): I have autofill working well in the following browsers: - Chrome - Android - Brave - Opera If anyone is interested in helping beta testing the next release of the mobile app with the autofill service, let me know. You can email me on the website using the contact form or join our gitter chatroom here: https://gitter.im/bitwarden/Lobby

GiteaMirror commented

@kspearrin commented on GitHub (Feb 1, 2017):

For those who wish to beta test autofill, attached is a beta build APK you can download and install. Please uninstall existing versions of bitwarden before installing this one. Also note that you shouldn't continue to use this version and should uninstall it and re-download from the play store once done testing.

Download here: [REMOVED - See google play link below for testing now]

@kspearrin commented on GitHub (Feb 1, 2017): For those who wish to beta test autofill, attached is a beta build APK you can download and install. Please uninstall existing versions of bitwarden before installing this one. Also note that you shouldn't continue to use this version and should uninstall it and re-download from the play store once done testing. Download here: [REMOVED - See google play link below for testing now]

GiteaMirror commented

@kspearrin commented on GitHub (Feb 5, 2017):

I've set up alpha testing on the Google play store now for this. You can get the nightly build for this here: https://play.google.com/apps/testing/com.x8bit.bitwarden

The plan is to have autofill released at some point next week.

@kspearrin commented on GitHub (Feb 5, 2017): I've set up alpha testing on the Google play store now for this. You can get the nightly build for this here: https://play.google.com/apps/testing/com.x8bit.bitwarden The plan is to have autofill released at some point next week.

GiteaMirror commented

2025-11-26 22:15:22 -06:00

@lucacome commented on GitHub (Feb 5, 2017):

Can't seem to login with the alpha...

@lucacome commented on GitHub (Feb 5, 2017): Can't seem to login with the alpha...

GiteaMirror commented

@kspearrin commented on GitHub (Feb 5, 2017):

@lucacome The alpha is still in being developed with some changes to the authentication process, so if you have 2FA turned on, you wont be able to log in currently. If you want to test you'll need to disable 2FA for now. Do you have 2FA turned on for your account?

@kspearrin commented on GitHub (Feb 5, 2017): @lucacome The alpha is still in being developed with some changes to the authentication process, so if you have 2FA turned on, you wont be able to log in currently. If you want to test you'll need to disable 2FA for now. Do you have 2FA turned on for your account?

GiteaMirror commented

2025-11-26 22:15:22 -06:00

@kspearrin commented on GitHub (Feb 6, 2017):

@lucacome 2FA is now available again with the latest alpha build.

@kspearrin commented on GitHub (Feb 6, 2017): @lucacome 2FA is now available again with the latest alpha build.

GiteaMirror commented

2025-11-26 22:15:23 -06:00

@kspearrin commented on GitHub (Feb 6, 2017):

Also, those who may want to test this outside of the play store, you can always download the latest APK attached to our CI builds here: https://ci.appveyor.com/project/bitwarden/mobile/build/artifacts

@kspearrin commented on GitHub (Feb 6, 2017): Also, those who may want to test this outside of the play store, you can always download the latest APK attached to our CI builds here: https://ci.appveyor.com/project/bitwarden/mobile/build/artifacts

GiteaMirror commented

2025-11-26 22:15:23 -06:00

@walrus543 commented on GitHub (Feb 8, 2017):

Video of Bitwarden 1.2.1
As you can see, the notification is automatically removed as soon as I open the notification panel or I open the keyboard.
Android 7.1.1 - OnePlus 3T

@walrus543 commented on GitHub (Feb 8, 2017): [Video of Bitwarden 1.2.1](https://webcloud.zaclys.com/index.php/s/dEjK4bwxHhNihHV) As you can see, the notification is automatically removed as soon as I open the notification panel or I open the keyboard. Android 7.1.1 - OnePlus 3T

GiteaMirror commented

2025-11-26 22:15:23 -06:00

@kspearrin commented on GitHub (Feb 8, 2017):

Another user reported the same thing when he had the lastpass auto fill service turned on still. When he turned off lastpass it started working correctly. I wasn't able to reproduce it though. Do you happen to have that on? Investigating....

@kspearrin commented on GitHub (Feb 8, 2017): Another user reported the same thing when he had the lastpass auto fill service turned on still. When he turned off lastpass it started working correctly. I wasn't able to reproduce it though. Do you happen to have that on? Investigating....

GiteaMirror commented

2025-11-26 22:15:24 -06:00

@kwiky commented on GitHub (Feb 8, 2017):

I have the same issue. I turned off lastpass service and turned on bitwarden service in accessibility settings, but i have never seen the bitwarden auto-fill notification.
Bitwarden 1.2.1 (436)
Samsung Galaxy S7 Edge

@kwiky commented on GitHub (Feb 8, 2017): I have the same issue. I turned off lastpass service and turned on bitwarden service in accessibility settings, but i have never seen the bitwarden auto-fill notification. Bitwarden 1.2.1 (436) Samsung Galaxy S7 Edge

GiteaMirror commented

2025-11-26 22:15:24 -06:00

@kspearrin commented on GitHub (Feb 8, 2017):

@kwiky what android version?

@kspearrin commented on GitHub (Feb 8, 2017): @kwiky what android version?

GiteaMirror commented

2025-11-26 22:15:24 -06:00

@kwiky commented on GitHub (Feb 8, 2017):

@kspearrin 6.0.1

@kwiky commented on GitHub (Feb 8, 2017): @kspearrin 6.0.1

GiteaMirror commented

2025-11-26 22:15:25 -06:00

@kwiky commented on GitHub (Feb 8, 2017):

@kspearrin sorry, it works on android apps and chrome, but not with firefox.
Sorry because lastpass always display his notification, and bitwarden notification is only displayed when login fields is detected. This is why i thought it doesn't works

@kwiky commented on GitHub (Feb 8, 2017): @kspearrin sorry, it works on android apps and chrome, but not with firefox. Sorry because lastpass always display his notification, and bitwarden notification is only displayed when login fields is detected. This is why i thought it doesn't works

GiteaMirror commented

@kwiky commented on GitHub (Feb 8, 2017):

This is maybe why lastpass always display this notification, because of apps like firefox ?

@kwiky commented on GitHub (Feb 8, 2017): This is maybe why lastpass always display this notification, because of apps like firefox ?

GiteaMirror commented

@kspearrin commented on GitHub (Feb 8, 2017):

Firefox browser is not supported at this time.

@kspearrin commented on GitHub (Feb 8, 2017): Firefox browser is not supported at this time.

GiteaMirror commented

@sreich commented on GitHub (Feb 8, 2017):

LastPass always displaying the notification is a feature. It's an option in its settings and it proves most useful because the auto detection is definitely not foolproof, even for LastPass.

Disabling LastPass service seemed to have worked around bitwarden hiding it's notification before you can hit it, but obviously isn't a fix.

@sreich commented on GitHub (Feb 8, 2017): LastPass always displaying the notification is a feature. It's an option in its settings and it proves most useful because the auto detection is definitely not foolproof, even for LastPass. Disabling LastPass service seemed to have worked around bitwarden hiding it's notification before you can hit it, but obviously isn't a fix.

GiteaMirror commented

@walrus543 commented on GitHub (Feb 8, 2017):

@kspearrin no changes after switching off Lastpass accessibility service.

@walrus543 commented on GitHub (Feb 8, 2017): @kspearrin no changes after switching off Lastpass accessibility service.

GiteaMirror commented

2025-11-26 22:15:27 -06:00

@kspearrin commented on GitHub (Feb 8, 2017):

@Primokorn

The way the accessibility service works is that it receives events every time something changes on your screen. That can be opening a new screen, focusing a textbox, opening the notification center, scrolling a web page, etc. When these events occur I get certain information such as which app is causing the event to occur, what text fields are on the screen, etc.

The logic every time these events are received is:

Is this a com.android.systemui event?
- Yes? Return immediately. Nothing to do.
- No? Continue to step 2.
Does the event's window "context" have any password fields on it?
- Yes? Show a notification.
- No? Dismiss any previous notifications.

Opening the notification center and keyboard are suppose to be com.android.systemui events, so they should be stopped (returned) from dismissing the notification. Obviously that doesn't seem to be happening with your device. Therefore it is going to step 2 in which it doesn't find any password field on the event's "context". In this case the context is likely your keyboard or notification center, not the information on the screen "behind" it.

Any idea why those wouldn't be classified as com.android.systemui events? Are you using some custom keyboard or something that might be classified differently?

Are you available at some time to help me debug the issue in live chat or anything? It's very difficult to try to resolve issues like this that I can't reproduce but are obviously affecting people. All reports I have heard about this so far have been on Android 7.1 which may also be a common denominator. Do you have any other devices you could test it out on to see if the issue persists?

@kspearrin commented on GitHub (Feb 8, 2017): @Primokorn The way the accessibility service works is that it receives events every time something changes on your screen. That can be opening a new screen, focusing a textbox, opening the notification center, scrolling a web page, etc. When these events occur I get certain information such as which app is causing the event to occur, what text fields are on the screen, etc. The logic every time these events are received is: 1. Is this a `com.android.systemui` event? - Yes? Return immediately. Nothing to do. - No? Continue to step 2. 2. Does the event's window "context" have any password fields on it? - Yes? Show a notification. - No? Dismiss any previous notifications. Opening the notification center and keyboard are suppose to be `com.android.systemui` events, so they should be stopped (returned) from dismissing the notification. Obviously that doesn't seem to be happening with your device. Therefore it is going to step 2 in which it doesn't find any password field on the event's "context". In this case the context is likely your keyboard or notification center, not the information on the screen "behind" it. Any idea why those wouldn't be classified as `com.android.systemui` events? Are you using some custom keyboard or something that might be classified differently? Are you available at some time to help me debug the issue in live chat or anything? It's very difficult to try to resolve issues like this that I can't reproduce but are obviously affecting people. All reports I have heard about this so far have been on Android 7.1 which may also be a common denominator. Do you have any other devices you could test it out on to see if the issue persists?

GiteaMirror commented

@sreich commented on GitHub (Feb 8, 2017):

On my lunch break, but I'm using GBoard (Google keyboard). I won't be able to help for a while so perhaps someone else can sooner.

@sreich commented on GitHub (Feb 8, 2017): On my lunch break, but I'm using GBoard (Google keyboard). I won't be able to help for a while so perhaps someone else can sooner.

GiteaMirror commented

2025-11-26 22:15:27 -06:00

@kspearrin commented on GitHub (Feb 8, 2017):

@sreich @Primokorn I just pushed build 437 to the beta slot. Please give that a try for a possible fix.

@kspearrin commented on GitHub (Feb 8, 2017): @sreich @Primokorn I just pushed build 437 to the beta slot. Please give that a try for a possible fix.

GiteaMirror commented

2025-11-26 22:15:27 -06:00

@walrus543 commented on GitHub (Feb 9, 2017):

@kspearrin this new update fixes the notification issue. Thanks. I'm on 445, though.

I tested with the mobile app of my mobile carrier (Bouygues Telecom).
In my vault my logins are stored this way:

Name: Bouygues My Account
Website: bouyguestelecom.fr
Username: my phone number
Password: ••••••••••••••••••••

While opening the app (package name: fr.bouyguestelecom.ecm.android) bitwarden is looking for ecm.android.
The screen 'logins for ecm.android' is loading again and again and bitwarden doesn't find anything.

@walrus543 commented on GitHub (Feb 9, 2017): @kspearrin this new update fixes the notification issue. Thanks. I'm on 445, though. I tested with the mobile app of my mobile carrier (Bouygues Telecom). In my vault my logins are stored this way: > Name: Bouygues My Account > Website: bouyguestelecom.fr > Username: my phone number > Password: •••••••••••••••••••• While opening the app (package name: **fr.bouyguestelecom.ecm.android**) bitwarden is looking for **ecm.android**. The screen '_logins for ecm.android_' is loading again and again and bitwarden doesn't find anything.

GiteaMirror commented

@kspearrin commented on GitHub (Feb 9, 2017):

Awesome. Thanks to @sreich I was able to somewhat reproduce the issue using gboard.

This is because apps are searched for differently that websites.

It's looking for a login with the explicit uri "androidapp://packagename" which is different than the web address.

I could start searching it for the reverse domain, but that could potentially be exploited since a person can give their app whatever reverse domain package name that they want. For example, I can call my package "com.google.bitwarden" and get it to list your google logins for you to auto fill into my app. Not really sure the best way to handle that.

@kspearrin commented on GitHub (Feb 9, 2017): Awesome. Thanks to @sreich I was able to somewhat reproduce the issue using gboard. This is because apps are searched for differently that websites. It's looking for a login with the explicit uri "androidapp://packagename" which is different than the web address. I could start searching it for the reverse domain, but that could potentially be exploited since a person can give their app whatever reverse domain package name that they want. For example, I can call my package "com.google.bitwarden" and get it to list your google logins for you to auto fill into my app. Not really sure the best way to handle that.

GiteaMirror commented

@kspearrin commented on GitHub (Feb 9, 2017):

There is a new feature in the web vault that lets you configure equivalent domains. So you could also associate androidapp://packagename with a Website domain and it will then suggest it to you when searching.

@kspearrin commented on GitHub (Feb 9, 2017): There is a new feature in the web vault that lets you configure equivalent domains. So you could also associate androidapp://packagename with a Website domain and it will then suggest it to you when searching.

GiteaMirror commented

@kspearrin commented on GitHub (Feb 10, 2017):

I'm pretty happy with the latest build. Unless anyone has any objections, I'll plan on pushing to production tomorrow some time.

@kspearrin commented on GitHub (Feb 10, 2017): I'm pretty happy with the latest build. Unless anyone has any objections, I'll plan on pushing to production tomorrow some time.

GiteaMirror commented

@kspearrin commented on GitHub (Feb 10, 2017):

Anyone have an Android 5.x device? I haven't been able to test that version and I am curious if the populating of text fields during the autofill process works or not. It doesn't on 4.4 so I show an alternate flow that offers copy/paste instead. Wondering if I need to do that for 5.x as well or not. 6.x and 7.x are tested and good to go.

@kspearrin commented on GitHub (Feb 10, 2017): Anyone have an Android 5.x device? I haven't been able to test that version and I am curious if the populating of text fields during the autofill process works or not. It doesn't on 4.4 so I show an alternate flow that offers copy/paste instead. Wondering if I need to do that for 5.x as well or not. 6.x and 7.x are tested and good to go.

GiteaMirror commented