Scan QR code, get "You cannot add an account until all accounts are decrypted"

[imc0]

Consider:

• a clean Google Chrome [91] browser with a fresh installation of Authenticator.cc [6.3.2]
• a pre-installed policy for this app which contains "enforcePassword: true"

When you go to add an MFA for the first time, Authenticator will ask you to set a password. (A side issue is that this password doesn't seem to be remembered if there are no stored MFAs - you can end up having to set the password several times if the process aborts, or if you remove the last MFA from the app - but that's not the subject of this bug report although it may be part of the underlying issue.)

So on a fresh installation, this sequence of events happens:

• press the QR icon at the top of the app
• Get asked to set a password
• Press OK, get a box that says "Success", but the QR scanner doesn't open.
• Press the QR icon again
• Scan the QR code
• get a dialogue which says "You cannot add a new account until all accounts are decrypted. Please enter the correct password before continuing."

Thus it appears to be impossible to add a first MFA using the QR code.

It works well if the data is entered manually; and once the first MFA has been added, it is then possible to add subsequent MFAs using the QR code.

[gzivdo]

This is general bug, not only after installing, its in firefox too, and exists for years. If you encrypt storage, you cannot add more entries.

[Sneezry]

This is general bug, not only after installing, its in firefox too, and exists for years. If you encrypt storage, you cannot add more entries.

I believe you are talking about different things. What you are talking about is, when some entries are not decrypted (show Encrypted instead of code), you are not able to add new accounts. That is as designed to avoid making code conflict worse.

If you meet such issue, you need take one of these two actions:

1. Click "Encrypted" to enter the correct password for that entry to decrypt data first.

Or

2. Remove the encrypted entry.

[mymindstorm]

@gzivdo please report issues like that. I was able to reproduce and it should be resolved with 328e20b and 2f2c7fa

@Sneezry how I was able to reproduce:

1. Use emergency data clear
2. Add a password
3. Close and open the extension
4. Try to scan qr
5. Error

[Sneezry]

@gzivdo please report issues like that. I was able to reproduce and it should be resolved with 328e20b and 2f2c7fa

@Sneezry how I was able to reproduce:

1. Use emergency data clear
2. Add a password
3. Close and open the extension
4. Try to scan qr
5. Error

The reason is here:

Authenticator/src/background.ts

Lines 272 to 273 in a936d5d

	(await EntryStorage.hasEncryptedEntry()) &&
	!encryption.getEncryptionStatus()

When you clear all entries, await EntryStorage.hasEncryptedEntry() is false, and after you add a password, encryption.getEncryptionStatus() is true. Thus, the error occures.

I believe gzivdo is talking another thing, because I see and exists for years in the comment. The above code doesn't exist too long.

What "issue" exists for years is if there is a conflict to decrypt entries, let's say, an entry is encrypted with 1234, and another entry is encrypted with abcd, when the user enter 1234 and apply the password, the extension will show code for the first entry normally, but show Encrypted for the second one. When the user is in such a situation, the extension reject to consider 1234 as the master password to encrypt new entries, because there are multiple passwords to encrypt different entries. The user must ensure all entries are encrypted with the same password. So, a must-do action is to decrypt the entry or remove it before add new entries.

Why could be there multiple passwords to encrypt different entries? It's a history issue. Long time ago, we don't store any information about the master password anywhere. We alway try to decrypt entries with anything the user input. In fact, a encrypted string does be able to be decrypted with a different password without exceptions - though the result is incorrect with the original secret. And the user may not be able to know the password is wrong, and add new entries with using that wrong password - and of course, the extension doesn't know that is the wrong password, either. Once this happens, there will be different master password to encrypt different entries.

But now, we have key hash of the master password locally, and we always verify the passowrd before use it to decrypt entries.