decrypt password not requested after browser shutdown

[aleqx]

If my browser crashes then after reopening it, the extension does not request the decrypt password. All codes are already decrypted and displayed. It seems that once decrypted they stay decrypted regardless of whether the browser dies or not. There is also no expiration timer. These are security risks.

[aleqx]

Hmm, I'm noticing a comment from you @mymindstorm in #375 suggesting you have in fact implemented both the above issues in the dev branch, is that correct? That would be great.

[mymindstorm]

@aleqx No, that doesn't mean it's fixed. Are you using Chrome or Firefox? Does this only occur after the browser crashes or during normally closing the browser too?

[aleqx]

I'm using the version from Chrome Web Store, which I believe does not have autolock ... ?

[mymindstorm]

Autolock is a new feature that isn't out yet. If you have a password set, Authenticator will lock itself on every new browsing session. I.e. every time Chrome is completely closed (not running in background) Authenticator will be locked.

[aleqx]

Just to eliminate confusion: is autolock supposed to work in the dev branch after the browser is closed? is autolock supposed to work in the dev branch after a certain time elapsed?

[mymindstorm]

@aleqx autolock is on dev currently. It's under settings and is only visible if you have a password set. If you fully close the browser and have a password it will lock no matter what autolock is set to.

Are you using the dev build? I think I know what's going on.

[aleqx]

Are you using the dev build? I think I know what's going on.

Not yet. I will try it tomorrow on my dev machine. I'm actually more interested in timed autolock - is that also available in dev?

[mymindstorm]

Timed autolock is in dev. I don't understand what feature you refer to as "also available in dev". You haven't described the issue very well.

Are your secrets even encrypted? When it is unlocked do you see a padlock icon next to the cog icon in the header?

[aleqx]

By "dev" i mean "dev branch". As I said, I'm not using the dev branch but the chrome web store version, and that i will try the dev branch version tomorrow. I also linked to another issue that talk about the same autolock features I mentioned. Decryption password should be requested:

1. after a timer elapsed.
2. on each browser startup.

Point 1. is much more important than 2. You said 2. is implemented in the dev branch. I asked if 1. is also impremented in the dev branch ... and I've now run out of ways to explain it.

[mymindstorm]

Thank you for that, it helps a lot. The issue you are referencing isn't relevant here.

Point 1 is in dev branch. Point 2 is in the web store version.

Do you see a padlock icon in the top left in header while decrypted like below?

[aleqx]

Yes, the padlock shows, i'm using the latest version from the chrome web store, v5.3.2. It does NOT ask for the decryption password after browser shutdown. Chrome v76.0.3809.132 windows x64

[KharmaScribbles]

I've only ever been asked for the decryption password after uninstalling/disabling the extension and reinstalling it. Or in the case of Powerwashing (resetting) my Chromebook, when my extensions sync up after the first login, I'm asked for the decrypt password (as normal, since syncing extensions is just installing them).

This is how it has always been for me and even has been the same for another authenticator extension which I was locked out of due to a password I swear I never set after powerwashing...

Well, I make sure to have backups now and store my decrypt password in a vault.

It would drive me bonkers though if it asked me to enter the password after each browser shutdown.

[aleqx]

Any update on this bug? What about the issue of locking after a timeout? Sounds like they should be fairly quick fixes, so I take it you've been overly busy. Would be nice to have them as more and more website use 2fa now and it would make your extension more secure.