Android unlocked without password ?

[fcartegnie]

I re-install a backup of my rom on my device, for that reason, after boot, Line wants to login.
Bitwarden shows notification, and appears as app popup after tapping the notification (maybe twice since i mess up with line).
The "popup app view" with bitwarden asks the main password,
and after tapping on that screen... the lock content appears !
I can scroll the entries and I have not typed the password yet !
I tried again right after and I was not able to reproduce.
Unfortunately I did not check that passwords were really there when clicking on entries.

• Does bitwarden stores data in clear and only encrypt passwords ? (in that case the app just show backend without decyphering passwords)
• Does android "popup view" has a bitmap cache (that survives reboot) and then a bug showing a previous bitwarden session ? (unlikely since i scrolled, but who knows)

[kspearrin]

This happens because your encryption key is persisted on the device in the Android Keystore. Restoring from a backup likely restored the encryption key as well.

All data stored on the device is encrypted. We do not store plaintext data.

[fcartegnie]

Unlocked again today, after reboot.
Amazon app login triggers bitwarden notification, bitwarden opens as popup.
Click outside popup and reclick on password input field.
New bitwarden notification, bitwarden opens as popup again.
Click on master password field and... opens without any input !
I have checked, and all passwords are there.

In background, 2 bitwarden app "window". Opening bitwarden solo app just never leaves the initial brand screen.

Sorry, but I don't see how, at least app unlocking, can't be a security issue.

[kspearrin]

Yes, as mentioned previously your encryption key is persisted to the Android Keystore. A reboot does not reset this... You should probably use a stricter lock option under Settings.