github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-18 11:44:32 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

Issue: Associating apps with Auto-fill can accidentally override synced logins. #934

New Issue
Closed
opened 2025-11-26 22:34:23 -06:00 by GiteaMirror · 2 comments
GiteaMirror commented 2025-11-26 22:34:23 -06:00
Owner
Copy Link

Originally created by @jerieljan on GitHub (Feb 25, 2020).

Due to unfortunate sync timings or poor connectivity, it’s possible to have older cached credentials replace newer synced credentials with the outdated save, because of the “Yes and Save” option in Bitwarden’s Auto-fill. (See the scenario I wrote below)

Wouldn’t it be better if the auto-fill service synced first and checked if the logins have updated before actually saving a new URI with the old login details?

Consider this scenario:

  1. I signed up on Service A with a username and password combo and saved it in Bitwarden on Desktop Firefox (let’s call this V1)
  2. I chose to open Service A on Android via a browser, opened Bitwarden and forced a sync to copy-paste the V1 credentials.
  3. After using Service A on Desktop Firefox for a while, I chose to enable Service A’s OTP and applied it to my saved credentials. I also added a custom field to store extra details (let’s call this V2).
  4. A few hours later, I tried downloading the Android app for Service A. At this point, V1 is still in the phone and sync hasn’t kicked in yet.
  5. I used Bitwarden’s auto-fill to login. It prompts me if I should associate the app to the credentials and chose “Yes and Save”. (And thus, a new version V3 is created)

Unfortunately, this has the effect of V1 being replaced by V3, with just V1 details and the URI for the app. The V2 details were replaced, likely because V3 appeared newer.

  1. Worse, sync kicks in after a while and V3 replaces V2 entirely. I’m locked out of my own account for Service A.
Originally created by @jerieljan on GitHub (Feb 25, 2020). Due to unfortunate sync timings or poor connectivity, it’s possible to have older cached credentials replace newer synced credentials with the outdated save, because of the “Yes and Save” option in Bitwarden’s Auto-fill. (See the scenario I wrote below) *Wouldn’t it be better if the auto-fill service synced first and checked if the logins have updated before actually saving a new URI with the old login details?* Consider this scenario: 1. I signed up on Service A with a username and password combo and saved it in Bitwarden on Desktop Firefox (let’s call this **V1**) 2. I chose to open Service A on Android via a browser, opened Bitwarden and forced a sync to copy-paste the V1 credentials. 3. After using Service A on Desktop Firefox for a while, I chose to enable Service A’s OTP and applied it to my saved credentials. I also added a custom field to store extra details (let’s call this **V2**). 4. A few hours later, I tried downloading the Android app for Service A. At this point, V1 is still in the phone and sync hasn’t kicked in yet. 5. I used Bitwarden’s auto-fill to login. It prompts me if I should associate the app to the credentials and chose “Yes and Save”. (And thus, a new version **V3** is created) Unfortunately, this has the effect of V1 being replaced by V3, with just V1 details and the URI for the app. *The V2 details were replaced, likely because V3 appeared newer.* 6. Worse, sync kicks in after a while and V3 replaces V2 entirely. I’m locked out of my own account for Service A.
GiteaMirror commented 2025-11-26 22:34:24 -06:00
Author
Owner
Copy Link

@nathanmerrill commented on GitHub (Mar 3, 2020):

+1 from me. I just lost my 2FA details due to this bug.

@nathanmerrill commented on GitHub (Mar 3, 2020): +1 from me. I just lost my 2FA details due to this bug.
GiteaMirror commented 2025-11-26 22:34:24 -06:00
Author
Owner
Copy Link

@vvolkgang commented on GitHub (Jun 20, 2024):

Issue migrated to https://github.com/bitwarden/mobile/issues/740

@vvolkgang commented on GitHub (Jun 20, 2024): Issue migrated to https://github.com/bitwarden/mobile/issues/740
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#934
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?