Skip to content

[FEAT] Biometrics: allow saving any data as master password #3142

@jack-packaj

Description

@jack-packaj

It's related to #399 and #1081, but should be easier to implement and should offer more safety and flexibility.
Same motivation: biometrics is extremely convenient, but inherently unsafe.

Currently it is only possible to save the master password.
Consider allowing saving any string (defaulting to the master password in the UI).

Usage:

  • The user opts in to save the master password with biometrics.
  • The user is presented with a dialog with an editable control, prepopulated with the master password.
  • The user makes certain alterations to the master password. Maybe adding some characters, maybe removing some, maybe replacing. The point is, only the user knows what exactly.
  • The mangled password is saved to the device.
  • When the user unlocks the database with the biometrics later, the mangled password is decrypted and attempted.
  • The unlock fails.
  • Now the user can adjust the mangled string accordingly to make it correct.
  • Since only the user knows which characters need to be added/removed/replaced, how many of them and where exactly, it should be safer than previously suggested fingerprint + pin or quick unlock combinations.

Example:
My master password is "HappyNewYearHappyNewYearMayWeAllHaveABananaNowAndThen".
I save it as "HappyNewYearHappyNewYearMayWeAllHaveAVisionNowAndThen".
Only I know how to turn the bad password into the good one. No one else does.
And it's way easier to adjust several random characters than to type the whole thing.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions