DejaDup keeps prompting for encryption password

[jacobzimmermann]

During the packup process the "Encryption Password Needed" dialog keeps popping up every couple of seconds, even though I have enabled the "remember password" options, which is incredibly annoying.

This is when using google drive as backup storage. The host OS is Ubuntu 20.10, amd64. Running org.gnome.DejaDup flatpak, version 42.6.

[mikix]

Hello! Thank you for your report and I'm sorry that Deja Dup is giving you problems.

One possibility is that it's not recognizing the password as correct? That would likely give you the symptom you're seeing.

Can you browse the backed up files in the Restore view of Deja Dup?

[jacobzimmermann]

Hi, thanks for following that up. The password was correct. I found that if I completely delete all backups as well as the backup folder itself on Google Drive and start afresh, then it works as it should. So I just hope I won't need to try to somehow reimport those old backups (which I'm keeping elsewhere in case...)

[opuk]

I'm also seeing this issue. But not only for encryption password, I also have to authenticate to google every time, which isn't very helpful for a scheduled backup. :)

The only output I get from the flatpak is:

(org.gnome.DejaDup:2): deja-dup-WARNING **: 15:39:58.290: BackendGoogle.vala:225: user interaction failed

(org.gnome.DejaDup:2): deja-dup-WARNING **: 15:40:06.520: Operation.vala:260: user interaction failed

[mikix]

Interesting - what desktop environment are you running @opuk?

[cspipaon]

I have the same issue. A notification keeps popping up asking for the encryption password. I am backing up on an external HDD so cannot comment on the google authentication.
When I click the notification, it opens the app but does not prompt me to enter the password. Also, I do not see any previous backups in the restore tab. Not sure if it is doing any backups...

I am running Pop OS 21.04 with GNOME 3.38.4.

EDIT: I think it is creating the backups, maybe I am not patient enough to see them load up in the Restore tab. I have a daily backup and the app is usually creating 4 files per day (i.e. per backup I guess?). These are

• (...).vol1.difftar.gpg
• (...).vol2.difftar.gpg
• (...).sigstar.gpg
• (...).manifest.gpg

Sometimes it also creates a (...).vol3.difftar.gpg file.

EDIT 2: I am running the Flatpak app with version 42.8.

EDIT 3: The Restore tab does show previously backed up files.

[mikix]

@cspipaon heyo - thanks for your report, sorry for the delayed response.

So for you, everything is working, just slowly and it always prompts for the password, regardless of whether you tell it to save the password?

It sounds like the encryption password just isn't being saved in the Passwords and Keys app (for unclear reasons). This can happen if you run under KDE (which none of you seem to be) as it doesn't have the password service we expect. But in GNOME, it should be working fine.

4 files per day (i.e. per backup I guess?).

Yes, for each backup snapshot, you'll see at least 3 new files: sigtar, manifest, and a number of volume files, depending on how much data is being backed up.

[cspipaon]

Hey, sorry I thought I had replied already...

So for you, everything is working, just slowly and it always prompts for the password, regardless of whether you tell it to save the password?

Yes, it works but I believe the bug occurred when I told it to save the password. As, if I remember correctly, it may have started when I first told it to save it. I used to use the app without saving and it worked fine.

It sounds like the encryption password just isn't being saved in the Passwords and Keys app (for unclear reasons).

I went to Password and Keys and the password was being saved. However, when I looked up which password it was encrypted (e.g. if I copied and pasted it, it was random symbols). This may be related to the issue as when I deleted this password the behaviour of DejaDup went back to normal... It now prompts me to enter the password, I enter it and a backup starts.

I must say, however, that the issue makes working with DejaDup annoying as it doesn't inform the user when a backup has started or when it has ended. Also, when the bug occurs, if you open the app, it shows the button for "Backup Now". When you click this, it says another instance is running but doesn't open the log window with the current backup process information...

Sorry, I can't give any more technical details... Hope this helps.

[mikix]

However, when I looked up which password it was encrypted (e.g. if I copied and pasted it, it was random symbols).

That's because of a technical detail of how flatpaks reach out of the sandbox - they encrypt the password when putting it into the user's keyring, as far as I recall. So that's normal.

I must say, however, that the issue makes working with DejaDup annoying as it doesn't inform the user when a backup has started or when it has ended.

Huh. That's odd - it definitely normally throws up a notification for the start and end of scheduled backups.

Also, when the bug occurs, if you open the app, it shows the button for "Backup Now". When you click this, it says another instance is running but doesn't open the log window with the current backup process information...

That's odd too - when a backup is running, and you open the app, it should show the progress dialog.

Brainstorming:

• Do you have any other instances / versions of deja-dup installed? System, snap, flatpak?
• Do you have notifications turned off for Deja Dup? Go to the Settings app, then Applications -> Backups. And make sure that Notifications are enabled.
• A new version was just released (43.0) - maybe that would help with something?

[cj2001]

Just adding in to the conversation that I am experiencing this too, also with Pop!_OS. I installed Deja Dup just before upgrading from 20.04 to 21.10. At first install it ran fine, created my backups on my Google Drive, etc. It asked me for my encryption password and I do believe that I told it to save the password. But I haven't been able to create a backup since then. My initial backup was created 17 days ago, so it would have been after 43.0 was released.

I do not have any other instances or versions of deja-dup installed. I also do have notifications turned on.

[mikix]

But I haven't been able to create a backup since then.

@cj2001 - that sounds like a different issue then. Can you please file a new ticket and provide the requested info there?

[adamlove86]

Hello, any update on how to stop the prompts? Honestly I don't care if it means not having a password to decrypt the backups, I'd just rather backups were automatic.
Many thanks for your great software though!

[mikix]

No update, sorry. The tl;dr; is that I haven't been able to reproduce, so it's been difficult to solve.

Some collected notes on the state of this ticket are:

• My guess at the culprit is some difficulty in storing and/or retrieving passwords from the "password store" via libsecret (in GNOME, this is visible in the Passwords & Keys app - could be something else in other desktops).
• This would explain why it can affect both encryption passwords and Google auth tokens - both store their keys via libsecret and prompt if they can't be retrieved.
• cspipaon reported seeing an entry in Passwords & Keys for the password - so maybe there's an issue retrieving the password but not storing it?
• opuk reported seeing the warning user interaction failed -- this is given by the secrets flatpak portal when the host system doesn't give it the secret token it wants.
• The flatpak should have all the permissions it needs for this. Modern versions of the flatpak portal have special portal support for libsecret. But we also specifically request access to org.freedesktop.secrets for old distros as well.
• So I'm thinking some part of the host desktop environment is not working / not wanting to give secrets to our flatpak.
• I've not been able to reproduce myself, which makes this hard to solve for me.

[youtous]

Hello, same issue on Arch:

deja-dup 44.2-1
libsecret 0.21.1-1
Kernel: x86_64 Linux 6.5.5-arch1-1
DE: GNOME 44.
storage backend = sftp

Nothing special in the logs; however, I am able to reproduce it across multiple computers.

1. Start a backup.
2. Deja-dup asks for an encryption password.
3. Enter the password and check "remember."
4. Wait for the backup to complete.
5. Start a new backup => deja-dup asks for the password again.

[mikix]

@youtous I tried installing Arch to test, but hoo boy, that install process is pretty low level.

Here's another tack - you can install Key Rack which should let you see the stored secrets of flatpak apps. (You can also use the Passwords & Keys app, but that will render flatpak app secrets as non-readable hashes.)

Do you see Deja Dup in Key Rack at all? (if not, that means we didn't store the password. If so, that means we couldn't read the password back)

[youtous]

@youtous I tried installing Arch to test, but hoo boy, that install process is pretty low level.

Haha, I'd recommend you to use Manjaro (https://manjaro.org/download/), for quick "arch" installation.

I don't use FlatPak at all and my understanding of Key Rack is the app targets FlatPak apps.
However, I can see the password stored in the Default Keyring of SeaHorse.

I tried to delete it then redoing the previously listed steps but it keeps asking for password. Logs:

asked to register item /org/freedesktop/secrets/collection/Default_5fkeyring/xx, but it's already registered (gnome-keyring-d)

seahorse 43.0
GNUPG: /usr/bin/gpg2 (2.2.41)
deja-dup 44.2

EDIT: I just realized that this repo is related to flatpak... Apologizes for the misrouting of this issue
This is related to https://gitlab.gnome.org/World/deja-dup/-/issues/277, do you prefer I switch on the linked issue?

[mikix]

EDIT: I just realized that this repo is related to flatpak... Apologizes for the misrouting of this issue This is related to https://gitlab.gnome.org/World/deja-dup/-/issues/277, do you prefer I switch on the linked issue?

Ah yeah, probably best to make a new ticket. I just left a comment on that old ticket, and it may be a different issue from yours. But this one here is flatpak-specific. (There's all sorts of reasons something can go wrong! 😦) -- I know I'm not the speediest person when responding though, sorry.