Can't export after setting a password

[d668]

Added a password in Security. Now When I try to click Import/Export I have a popup

You cannot add a new account or export data until all accounts are decrypted. Please enter the correct password before continuing

Platform: Windows 10

• Browser: Chrome
• Browser Version: Version 79.0.3945.88 (Official Build) (64-bit)

[d668]

also naturally can't remove password

[d668]

there was one entry that kept showing ENCRYPTED, I had to delete it and this started working. Def a bug

[Sneezry]

It seems one of your entries cannot be decrypted with the master password you entered. And that is the reason export doesn't work (cannot decrypt secret data for you to export backup).

If you know the correct password, you can click the word ENCRYPTED, and a password input box popups in which you can provide correct password to decrypt the entry.

If you don't know the correct password, or the entry has been broken, then you have to remove it.

I believe this is a feature as designed.

Please feel free to leave your comment if you have any question/suggestion for the design.

[d668]

this is very confusing and should be fixed imo. The system shouldn't allow setting master password if afterward it behaves in such a way

[Sneezry]

If the extension runs as expected, there should not be entries encrypted with different passwords (if you input incorrect password, the extension prevents you from importing backups and adding new accounts), but currently I have no idea why you meet such a situation. There may be a bug to allow you to add entires encrypted with another password or there's some reason makes the entry broken. (@mymindstorm please correct me if I make any mistake, thanks)

So this design is much for expection handling (but not to avoid making this exception happen). Maybe we should change to export backups only can be decrypted, but not just disable it entirely.

Any idea?

[d668]

Maybe we should change to export backups only can be decrypted, but not just disable it entirely.

probably, because it really looked like a dead end for a while. This rogue entry that I probably added by mistake some day with a bad formatted key or something, blocked all UI

[mymindstorm]

In the published version "Encrypted" means either that the data is invalid or it couldn't verify the data with the provided password. I think #376 already fixes this.

argon2 should also help fix this because it only has to validate against one password instead of verifying each one individually.

[Sneezry]

@mymindstorm I think here we discuss two things.

The first one is how to avoid invalid data or data encrypted with different passwords.

The second one is if invalid data has already existed, how should we handle the exception.

argon2 should resolve the second one.

To the first one, we still ask user to provide correct password before export backups and add new accounts, and this design may make user confused and have no idea how to make export work again.

[mymindstorm]

First should already be extremely unlikely to happen unless someone migrates invalid data from 4.x.

Second one is solved by #376 by treating "Invalid" and "Encrypted" data differently.

This looks like a bug with encryption. Try creating an encrypted entry with the secret "a". We only do a length check in this part of the code, causing an encryption error:

Authenticator/src/models/encryption.ts

Lines 50 to 52 in 54ab5dc

	if (decryptedSecret.length < 8) {
	return null;
	}

[Sneezry]

Indeed, I can reproduce on my side. A quick fix is to check secret length when add new account

Authenticator/src/components/Popup/AddAccountPage.vue

Lines 62 to 63 in 54ab5dc

	!/^[a-z2-7]+=*$/i.test(this.newAccount.secret) &&
	!/^[0-9a-f]+$/i.test(this.newAccount.secret)