github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-08 12:58:36 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[GH-ISSUE #631] Possible Security Hole: Entering Master Password with "Show Password" On Triggers Word Suggestions #37817

New Issue
Closed
opened 2026-04-23 15:35:03 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-23 15:35:03 -05:00
Owner
Copy Link

Originally created by @adamsmd on GitHub (Oct 18, 2019).
Original GitHub issue: https://github.com/bitwarden/android/issues/631

When entering the master password, clicking the eye icon to show the password, changes the keyboard to include word suggestions / text prediction. (This may also apply to other places with the "show password" option.) My concern is that this might also cause the keyboard to use what the user types (in this case his or her password) to train word suggestions / text prediction.

However, I don't know enough about mobile platforms to know under what conditions the user's input is used for training, so I might wrong about this being a security hole. I would be grateful for any information about this.

I note that the code toggles the IsPassword property to control whether to show the password. The fix might be as simple as also setting IsTextPredictionEnabled to false on the text control. Though again this depends on exactly what controls whether user input is used for training word suggest / text predictions.

Tested On

  • Android (Lineage) version 9
  • BitWarden version 2.1.1

Steps to Reproduce:

  1. Logout of BitWarden and then start BitWarden so you are on the "Verify Master Password" screen.
  2. Click the "eye" icon so the password is shown.
  3. Click in the text box so they on-screen keyboard appears.
  4. Start typing a password.

Result

  • The on-screen keyboard displays word suggestions and text completions based on the typed password.

Vulnerabilities:

  1. If word suggest involves querying outside services (I don't know if this is the case), this results in sending the thus far typed password to those outside services.
  2. If the typed password is used to train word suggest (I don't know if this is the case), this results in information about the password being stored in that training data.
  3. If the user selects one of those suggestions and that fact is used to train word suggest (I don't know if this is the case), this results in information about the password being stored in that training data.
Originally created by @adamsmd on GitHub (Oct 18, 2019). Original GitHub issue: https://github.com/bitwarden/android/issues/631 When entering the master password, clicking the eye icon to show the password, changes the keyboard to include word suggestions / text prediction. (This may also apply to other places with the "show password" option.) My concern is that this might also cause the keyboard to use what the user types (in this case his or her password) to train word suggestions / text prediction. However, I don't know enough about mobile platforms to know under what conditions the user's input is used for training, so I might wrong about this being a security hole. I would be grateful for any information about this. I note that the code toggles the `IsPassword` property to control whether to show the password. The fix might be as simple as also setting `IsTextPredictionEnabled` to false on the text control. Though again this depends on exactly what controls whether user input is used for training word suggest / text predictions. ### Tested On - Android (Lineage) version 9 - BitWarden version 2.1.1 ### Steps to Reproduce: 1. Logout of BitWarden and then start BitWarden so you are on the "Verify Master Password" screen. 2. Click the "eye" icon so the password is shown. 3. Click in the text box so they on-screen keyboard appears. 4. Start typing a password. ### Result - The on-screen keyboard displays word suggestions and text completions based on the typed password. ### Vulnerabilities: 1. If word suggest involves querying outside services (I don't know if this is the case), this results in sending the thus far typed password to those outside services. 2. If the typed password is used to train word suggest (I don't know if this is the case), this results in information about the password being stored in that training data. 3. If the user selects one of those suggestions and that fact is used to train word suggest (I don't know if this is the case), this results in information about the password being stored in that training data.
GiteaMirror commented 2026-04-23 15:35:04 -05:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Oct 20, 2019):

This is why we set the ImeOptions for all input fields in Bitwarden to NoPersonalizedLearning (i.e. incognito keyboard). Are you actually seeing learning occurring?

https://github.com/bitwarden/mobile/blob/master/src/Android/Renderers/CustomEntryRenderer.cs#L23

<!-- gh-comment-id:544210598 --> @kspearrin commented on GitHub (Oct 20, 2019): This is why we set the `ImeOptions` for all input fields in Bitwarden to `NoPersonalizedLearning` (i.e. incognito keyboard). Are you actually seeing learning occurring? https://github.com/bitwarden/mobile/blob/master/src/Android/Renderers/CustomEntryRenderer.cs#L23
GiteaMirror commented 2026-04-23 15:35:04 -05:00
Author
Owner
Copy Link

@adamsmd commented on GitHub (Oct 20, 2019):

I wasn't aware of the NoPersonalizedLearning setting. I am not actually seeing learning occurring. I am closing this issue as that setting means I was wrong about there possibly being a security hole here.

<!-- gh-comment-id:544271987 --> @adamsmd commented on GitHub (Oct 20, 2019): I wasn't aware of the `NoPersonalizedLearning` setting. I am not actually seeing learning occurring. I am closing this issue as that setting means I was wrong about there possibly being a security hole here.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#37817
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?