Security Vulnerability in Android app's new Vault Locking animation
In version 6.5.3 of 1Password for Android, there is a major security flaw in the new vault locking animation that plays when opening the app after it has been swiped away, the screen locked, or any other action that closes the app's view. When opening the app again after the initial close, which puts the app back into the locked state requiring a pin, an animation plays of the lock closing - the problem is, your sensitive passwords and logins are displayed in the background! If you happened to have a password open with the password revealed, even that password will be displayed for the half second or so it takes the animation to play. It appears to show exactly whatever screen you last left the app from, regardless of how sensitive the content there was.
I will say that my phone's operating system is rather non-standard (I'm running a ROM designed for the LG G4 on my G3 that's a custom tweak), but I don't think this should have anything to do with how the app resumes, and I've had no other issues with the software.
1Password Version: 6.5.3
Extension Version: Not Provided
OS Version: Android 6.0
Sync Type: Dropbox
Comments
-
@iacondios: Thanks for reaching out, and including those details! I'm not able to reproduce what you're seeing here, but I'll see if we have anyone who can.
In my case, any time I leave 1Password (whether that be using another app, home screen, or even just the app switcher), 1Password goes to a grey screen. When returning to it, the grey screen is updated to display the 1Password logo and unlock option(s).
We just haven't had any other reports since the stable version was released two weeks ago, or during the beta. So I'm wondering if this is something with the specific setup you're using which is preventing 1Password from knowing it isn't the active app for some reason.
If you're still having trouble, the best thing to do will be to restart your device, reproduce the same issue, and then generate a diagnostic report so we can look at the logs to determine exactly what is happening:
https://support.1password.com/diagnostics/?android
Please send it to support+android@agilebits.com add the following code (including the square brackets) to the subject of your diagnostics email before sending it:
[#YQJ-81516-554]
This will link your diagnostics to our current discussion. Let me know once you've sent it. Once we see it we should be able to better assist you. Thanks in advance!
ref: YQJ-81516-554
0 -
Ok, I've sent the diagnostics email.
It seems that once again my unique talent of uncovering extremely niche bugs has surfaced... It is interesting that you say that when you leave 1Password it goes to a gray screen - for my device, there is no special screen shown during leaving, it just goes out of view - the app closes immediately on interaction. For pressing the home button, it instantly fades to the home screen, and for opening the running apps drawer (or whatever that square button does), it move the app window to the bottom of the list, and the contents are turned completely white. Of course, if you re-select the app from that state, it re-renders the app as it was previously and then plays the close animation before greeting you with the gray locked state.
In earlier versions of 1Password for Android, I don't recall it playing the locking animation, you would simply resume the activity and be greeted with the gray screen, the 1Password logo, and the input for your PIN or master password. It seems to me, that the animation to lock the vault is intended to be played on pause when you leave the app, but for some reason gets delayed to on resume - maybe something in the operating system taking control away from the app faster than intended? I'm mostly spitballing, but I am in the midst of Android app development myself (as a mostly novice developer) so I feel I might have some insight on the problem.
Hopefully we can get to the bottom of this! If nothing else, something in a previous version worked properly for me, so there's at least a base state to return to.
0 -
Ok, I've sent the diagnostics email.
@iacondios: Awesome! Thanks. We've got it. We'll take a look and get back to you there. :)
It seems that once again my unique talent of uncovering extremely niche bugs has surfaced...
It may be that the custom ROM designed for another device plays a part as well. ;)
It is interesting that you say that when you leave 1Password it goes to a gray screen - for my device, there is no special screen shown during leaving, it just goes out of view - the app closes immediately on interaction.
What I mean is that if I'm paying attention, I can see the screen go grey briefly before 1Password leaves the screen, and when I return to the app the screen is grey and then quickly reveals whatever I'd be viewing previously. That's if it isn't locked. If it is locked then (either due to the timer or "lock on exit") then the grey screen gives way to the lock screen instead.
For pressing the home button, it instantly fades to the home screen, and for opening the running apps drawer (or whatever that square button does), it move the app window to the bottom of the list, and the contents are turned completely white. Of course, if you re-select the app from that state, it re-renders the app as it was previously and then plays the close animation before greeting you with the gray locked state.
Yeah, that's where we differ completely. I'm using stock Android, so I wonder what's up with the "fading" in your case. For me the screen moves down and out of view quickly.
In earlier versions of 1Password for Android, I don't recall it playing the locking animation, you would simply resume the activity and be greeted with the gray screen, the 1Password logo, and the input for your PIN or master password. It seems to me, that the animation to lock the vault is intended to be played on pause when you leave the app, but for some reason gets delayed to on resume - maybe something in the operating system taking control away from the app faster than intended? I'm mostly spitballing, but I am in the midst of Android app development myself (as a mostly novice developer) so I feel I might have some insight on the problem.
Hopefully we can get to the bottom of this! If nothing else, something in a previous version worked properly for me, so there's at least a base state to return to.Indeed, thanks for the additional details! We'll see what we can find. :)
0
