github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-05 23:38:51 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[PR #6126] [MERGED] [PM-27752] Add certificate signature verification to AuthenticatorBridge #43428

New Issue
Closed
opened 2026-04-23 22:04:10 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 22:04:10 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/bitwarden/android/pull/6126
Author: @SaintPatrck
Created: 11/5/2025
Status: ✅ Merged
Merged: 11/6/2025
Merged by: @SaintPatrck

Base: main ← Head: PM-27752/authbridge-package-name-validation

📝 Commits (10+)

  • 8ddc5c1 PM-27752: Add certificate signature verification to AuthenticatorBridge
  • bbc8e07 Add separate known certs for debug and release builds
  • ef8c405 PM-27752: Omit PasswordManagerSignatureVerifier from test coverage
  • 3f79ef0 Remove unnecessary Robolectric test dependencies
  • b5ff5eb Remove unnecessary RequiresApi annotation
  • 4d23355 Log exceptions in PasswordManagerSignatureVerifier
  • dd9e829 Log signature verification failure for unknown certificates
  • 860a481 Enhance signature verification with logging and constant-time comparison
  • 4897c61 Add package name to signature verification logs
  • abd70db Fix typo in log message

📊 Changes

10 files changed (+200 additions, -19 deletions)

View changed files

📝 app/build.gradle.kts (+3 -3)
📝 authenticatorbridge/CHANGELOG.md (+7 -0)
📝 authenticatorbridge/build.gradle.kts (+2 -1)
➕ authenticatorbridge/src/debug/res/values/strings.xml (+8 -0)
📝 authenticatorbridge/src/main/kotlin/com/bitwarden/authenticatorbridge/factory/AuthenticatorBridgeFactory.kt (+2 -0)
📝 authenticatorbridge/src/main/kotlin/com/bitwarden/authenticatorbridge/manager/AuthenticatorBridgeManagerImpl.kt (+10 -9)
➕ authenticatorbridge/src/main/kotlin/com/bitwarden/authenticatorbridge/util/PasswordManagerSignatureVerifier.kt (+14 -0)
➕ authenticatorbridge/src/main/kotlin/com/bitwarden/authenticatorbridge/util/PasswordManagerSignatureVerifierImpl.kt (+128 -0)
➕ authenticatorbridge/src/release/res/values/strings.xml (+12 -0)
📝 authenticatorbridge/src/test/kotlin/com/bitwarden/authenticatorbridge/manager/AuthenticatorBridgeManagerTest.kt (+14 -6)

📄 Description

🎟️ Tracking

Fixes PM-27752 (clones VULN-314)

📔 Objective

This PR implements cryptographic certificate signature verification in the AuthenticatorBridge library to prevent malicious applications from spoofing legitimate Password Manager package names and intercepting TOTP secrets.

Problem: The original implementation only validated package names via string comparison, which is insufficient security. A malicious app could register with a matching package name (e.g., com.x8bit.bitwarden) and intercept sensitive TOTP data during inter-app communication.

Solution:

  • Introduced PasswordManagerSignatureVerifier that validates APK signing certificates using SHA-256 fingerprints against a hardcoded whitelist
  • Rejects apps with multiple signers to prevent signature rotation attacks
  • Uses GET_SIGNING_CERTIFICATES (API 28+) for secure certificate retrieval
  • Implements fail-closed error handling on all validation paths
  • Separate certificate whitelists for debug/release build variants

Security Impact: This change establishes cryptographic proof of application identity, ensuring only genuine Bitwarden Password Manager apps can connect to the Authenticator Bridge and access TOTP secrets.

📸 Screenshots

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/bitwarden/android/pull/6126 **Author:** [@SaintPatrck](https://github.com/SaintPatrck) **Created:** 11/5/2025 **Status:** ✅ Merged **Merged:** 11/6/2025 **Merged by:** [@SaintPatrck](https://github.com/SaintPatrck) **Base:** `main` ← **Head:** `PM-27752/authbridge-package-name-validation` --- ### 📝 Commits (10+) - [`8ddc5c1`](https://github.com/bitwarden/android/commit/8ddc5c1620c93be2db7e2d25345cda47eabc8962) PM-27752: Add certificate signature verification to AuthenticatorBridge - [`bbc8e07`](https://github.com/bitwarden/android/commit/bbc8e070093302c19125d7de83a96222ab2f7216) Add separate known certs for debug and release builds - [`ef8c405`](https://github.com/bitwarden/android/commit/ef8c4052022389269029bdf66610d2322462d034) PM-27752: Omit PasswordManagerSignatureVerifier from test coverage - [`3f79ef0`](https://github.com/bitwarden/android/commit/3f79ef0149b9f19ff9f956ee932b8cb24658be27) Remove unnecessary Robolectric test dependencies - [`b5ff5eb`](https://github.com/bitwarden/android/commit/b5ff5eb74e83e2bcee1edae9ce88f04b599c6459) Remove unnecessary RequiresApi annotation - [`4d23355`](https://github.com/bitwarden/android/commit/4d23355087778b9bf58a7ab8be09e6ce140f95e2) Log exceptions in PasswordManagerSignatureVerifier - [`dd9e829`](https://github.com/bitwarden/android/commit/dd9e829bd490ffe577c4f897440a0e0845c4b813) Log signature verification failure for unknown certificates - [`860a481`](https://github.com/bitwarden/android/commit/860a4818f1f3ee1d39925c58a67c3ad912b87a6a) Enhance signature verification with logging and constant-time comparison - [`4897c61`](https://github.com/bitwarden/android/commit/4897c61344d1c2f7a4ab8d1372a768cffca51117) Add package name to signature verification logs - [`abd70db`](https://github.com/bitwarden/android/commit/abd70db7054ed751ecdfcaaa1e2a2bf10c0ab066) Fix typo in log message ### 📊 Changes **10 files changed** (+200 additions, -19 deletions) <details> <summary>View changed files</summary> 📝 `app/build.gradle.kts` (+3 -3) 📝 `authenticatorbridge/CHANGELOG.md` (+7 -0) 📝 `authenticatorbridge/build.gradle.kts` (+2 -1) ➕ `authenticatorbridge/src/debug/res/values/strings.xml` (+8 -0) 📝 `authenticatorbridge/src/main/kotlin/com/bitwarden/authenticatorbridge/factory/AuthenticatorBridgeFactory.kt` (+2 -0) 📝 `authenticatorbridge/src/main/kotlin/com/bitwarden/authenticatorbridge/manager/AuthenticatorBridgeManagerImpl.kt` (+10 -9) ➕ `authenticatorbridge/src/main/kotlin/com/bitwarden/authenticatorbridge/util/PasswordManagerSignatureVerifier.kt` (+14 -0) ➕ `authenticatorbridge/src/main/kotlin/com/bitwarden/authenticatorbridge/util/PasswordManagerSignatureVerifierImpl.kt` (+128 -0) ➕ `authenticatorbridge/src/release/res/values/strings.xml` (+12 -0) 📝 `authenticatorbridge/src/test/kotlin/com/bitwarden/authenticatorbridge/manager/AuthenticatorBridgeManagerTest.kt` (+14 -6) </details> ### 📄 Description ## 🎟️ Tracking Fixes PM-27752 (clones VULN-314) ## 📔 Objective This PR implements cryptographic certificate signature verification in the AuthenticatorBridge library to prevent malicious applications from spoofing legitimate Password Manager package names and intercepting TOTP secrets. **Problem:** The original implementation only validated package names via string comparison, which is insufficient security. A malicious app could register with a matching package name (e.g., `com.x8bit.bitwarden`) and intercept sensitive TOTP data during inter-app communication. **Solution:** - Introduced `PasswordManagerSignatureVerifier` that validates APK signing certificates using SHA-256 fingerprints against a hardcoded whitelist - Rejects apps with multiple signers to prevent signature rotation attacks - Uses `GET_SIGNING_CERTIFICATES` (API 28+) for secure certificate retrieval - Implements fail-closed error handling on all validation paths - Separate certificate whitelists for debug/release build variants **Security Impact:** This change establishes cryptographic proof of application identity, ensuring only genuine Bitwarden Password Manager apps can connect to the Authenticator Bridge and access TOTP secrets. ## 📸 Screenshots <!-- Required for any UI changes; delete if not applicable. Use fixed width images for better display. --> ## ⏰ Reminders before review - Contributor guidelines followed - All formatters and local linters executed and passed - Written new unit and / or integration tests where applicable - Protected functional changes with optionality (feature flags) - Used internationalization (i18n) for all UI strings - CI builds passed - Communicated to DevOps any deployment requirements - Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team ## 🦮 Reviewer guidelines <!-- Suggested interactions but feel free to use (or not) as you desire! --> - 👍 (`:+1:`) or similar for great changes - 📝 (`:memo:`) or ℹ️ (`:information_source:`) for notes or general info - ❓ (`:question:`) for questions - 🤔 (`:thinking:`) or 💭 (`:thought_balloon:`) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion - 🎨 (`:art:`) for suggestions / improvements - ❌ (`:x:`) or ⚠️ (`:warning:`) for more significant problems or concerns needing attention - 🌱 (`:seedling:`) or ♻️ (`:recycle:`) for future improvements or indications of technical debt - ⛏ (`:pick:`) for minor or nitpick changes --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 22:04:10 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#43428
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?