Possible Security Hole: Entering Master Password with "Show Password" On Triggers Word Suggestions

[adamsmd]

When entering the master password, clicking the eye icon to show the password, changes the keyboard to include word suggestions / text prediction. (This may also apply to other places with the "show password" option.) My concern is that this might also cause the keyboard to use what the user types (in this case his or her password) to train word suggestions / text prediction.

However, I don't know enough about mobile platforms to know under what conditions the user's input is used for training, so I might wrong about this being a security hole. I would be grateful for any information about this.

I note that the code toggles the IsPassword property to control whether to show the password. The fix might be as simple as also setting IsTextPredictionEnabled to false on the text control. Though again this depends on exactly what controls whether user input is used for training word suggest / text predictions.

Tested On

• Android (Lineage) version 9
• BitWarden version 2.1.1

Steps to Reproduce:

1. Logout of BitWarden and then start BitWarden so you are on the "Verify Master Password" screen.
2. Click the "eye" icon so the password is shown.
3. Click in the text box so they on-screen keyboard appears.
4. Start typing a password.

Result

• The on-screen keyboard displays word suggestions and text completions based on the typed password.

Vulnerabilities:

1. If word suggest involves querying outside services (I don't know if this is the case), this results in sending the thus far typed password to those outside services.
2. If the typed password is used to train word suggest (I don't know if this is the case), this results in information about the password being stored in that training data.
3. If the user selects one of those suggestions and that fact is used to train word suggest (I don't know if this is the case), this results in information about the password being stored in that training data.

[kspearrin]

This is why we set the ImeOptions for all input fields in Bitwarden to NoPersonalizedLearning (i.e. incognito keyboard). Are you actually seeing learning occurring?

https://github.com/bitwarden/mobile/blob/master/src/Android/Renderers/CustomEntryRenderer.cs#L23

[adamsmd]

I wasn't aware of the NoPersonalizedLearning setting. I am not actually seeing learning occurring. I am closing this issue as that setting means I was wrong about there possibly being a security hole here.