Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature request: Linux fingerprint reader support (via fprint) #5991

Closed
goetzc opened this issue Jan 24, 2021 · 35 comments
Closed

Feature request: Linux fingerprint reader support (via fprint) #5991

goetzc opened this issue Jan 24, 2021 · 35 comments
Labels
bounty 💰 feature: QuickUnlock new feature platform: Linux
Milestone
v2.8.0

Comments

@goetzc
Copy link

goetzc commented Jan 24, 2021 •
edited by issuehunt-oss bot

Issuehunt badges

Summary

On GNU/Linux this can be done around fprint, which is the current general method to manage fingerprint readers.

From the projects' homepage:

The fprint project aims to plug a gap in the Linux desktop: support for consumer fingerprint reader devices.

More info:

https://www.freedesktop.org/wiki/Software/fprint/
http://www.linux-pam.org/

Context

Opening a Linux-specific ticket, similar to the Windows-specific one, as the general issue can be to broad to support both potential bounties for each OS.

IssueHunt Summary

Backers (Total: $210.00)

Become a backer now!

Or submit a pull request to get the deposits!

Tips
@issuehunt-oss
Copy link

issuehunt-oss bot commented Jan 24, 2021

@goetzc has funded $100.00 to this issue.

@goetzc goetzc mentioned this issue Jan 24, 2021
Closed
@droidmonkey droidmonkey added this to the v2.7.0 milestone Jan 24, 2021
@issuehunt-oss
Copy link

issuehunt-oss bot commented Jan 25, 2021

@johanricher has funded $2.00 to this issue.

@issuehunt-oss
Copy link

issuehunt-oss bot commented Jan 25, 2021

@johanricher has funded $18.00 to this issue.

@issuehunt-oss
Copy link

issuehunt-oss bot commented Jan 27, 2021

An anonymous user has funded $20.00 to this issue.

@vorstrelok vorstrelok mentioned this issue Feb 2, 2021
Closed
@issuehunt-oss
Copy link

issuehunt-oss bot commented Feb 20, 2021

@spiregarden has funded $40.00 to this issue.

@appetrosyan
Copy link

Is anyone working on this issue?

@benwaffle
Copy link

1password supports this as quick unlock. On startup you enter your master password, and for quickunlock it's done via polkit so that a native GNOME fingerprint dialog pops up.

@michaelk83
Copy link

michaelk83 commented Jun 15, 2021 •
edited

it's done via polkit so that a native GNOME fingerprint dialog pops up.

There's probably more than one way to do it. It's just that there are multiple other things that need to be finished first.

edit: This could be done with platform-specific ifdefs without waiting for all the other stuff, but it will be cleaner if at least the common interface is implemented first.

@michaelk83 michaelk83 mentioned this issue Jun 15, 2021
Closed
@michaelk83
Copy link

Implementation note:
If this is going to save the encrypted DB passphrase similar to the TouchID and WinHello implementations, the user-space keyring (secret service) is not what you want for that (especially when KPXC is itself used as the secret service backend). This should use the kernel keyring:
https://man7.org/linux/man-pages/man7/keyrings.7.html
https://man7.org/linux/man-pages/man7/persistent-keyring.7.html

@issuehunt-oss
Copy link

issuehunt-oss bot commented Jun 29, 2021

An anonymous user has funded $50.00 to this issue.

@Qix-
Copy link

Qix- commented Jul 17, 2021

⚠️ IssueHunt is abandoned.

If you are putting money into it, you are losing it. Nobody will be able to receive that money as IssueHunt is not responding to withdrawal requests.

Just a heads up. It's best to just forget about it.

@droidmonkey
Copy link
Member

Github really needs to start an internal bounty program...

@issuehunt-oss
Copy link

issuehunt-oss bot commented Jul 18, 2021

@johanricher has cancelled funding for this issue.(Cancelled amount: $2.00) See it on IssueHunt

@issuehunt-oss
Copy link

issuehunt-oss bot commented Jul 18, 2021

@johanricher has cancelled funding for this issue.(Cancelled amount: $18.00) See it on IssueHunt

@michaelk83
Copy link

I don't know if there are really problems with IssueHunt, but there is no message about it on their website, and no relevant results in a quick Google search. It looks functional.

@droidmonkey
Copy link
Member

There is chatter on Twitter, but it looks like a recent development

@droidmonkey droidmonkey modified the milestones: v2.7.0, v2.8.0 Mar 21, 2022
@MatthewFallon
Copy link

MatthewFallon commented Jul 27, 2022 •
edited

Want to check on the status of this.

Some form of speed authentication in general on trusted devices, especially for the length of the login session or active process, seems like an absolutely acceptable thing to support if it is not difficult to support long term.

Based on some of the comments above, it seems that the process could go something like this:

  1. Require verification through polkit to authorize saving the password.
    • allow polkit agents on major distributions to handle authentication with fprint and/or password based on user preferences
  2. Save password using the linux kernels in-mem keyring as mentioned above. Save to the process-keyring with only permissions for the active main process to find and access this information itself.
    • Will only last for the length of the process running keypass, closing keypass or closing the session will allow this data to be deleted by the system.
    • Similar to how the current implementation of windows hello auth is working from my observations.
  3. Upon database being locked, require the unlock to re-authenticate through polkit as the user before retrieving the password as the main process for unlocking the database avoiding password re-entry.

I've not been around the block so to speak as a programmer so if any of that is way off base please feel free to let me know, otherwise if it's not already in process would be happy to help put in work as I genuinely love this project and use it everywhere.

I've seen some valid commentary back and forth on a few of these related issues. Yes, it would make it less secure on the device, and making it an opt-in per device if that is the concern is completely fine. Many less-technical users still understand the trade-off and are fine with it, the users that are not fine with this tradeoff can leave it off, that is totally fine.

I think that the general user pattern of making the password on the database file itself very long is a good idea to encourage if the file will be shared between systems. Avoiding users feeling the need to shorten their master password because of inconvenience on trusted devices seems like a fair call, especially as a product that helps keepass feel much more consumer friendly in general.

@michaelk83
Copy link

Sounds about right. I don't think anyone is working on this at the moment.

@dangarthwaite
Copy link

Do we need an app to promise payment for a bounty?

I pledge $200 USD via paypal, BTC, ETH, or ADA if apt install keepassxc supports the fingerprint reader on my framework laptop . Offer only good during 2023.

@mskvsk
Copy link

mskvsk commented Jan 12, 2023

I pledge $200 USD via paypal, BTC, ETH, or ADA if apt install keepassxc supports the fingerprint reader on my framework laptop . Offer only good during 2023.

I am going to match that for pacman -S keepassxc and the latest Thinkpads.

HexF added a commit to HexF/keepassxc that referenced this issue Jan 12, 2023
@HexF
Add Polkit Quick Unlock mechanism
d703d6e 
This commit and subsequent pull request adds support for Quick Unlock on Linux via Polkit
Polkit allows for authentication of many means, including fingerprint scanning fixing Issue keepassxreboot#5991
Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other mediums easier.
This also fixes keepassxreboot#3337, giving fingerprint reader support to the final major supported platform - Linux.
@HexF HexF mentioned this issue Jan 12, 2023
Merged
HexF added a commit to HexF/keepassxc that referenced this issue Jan 12, 2023
@HexF
Add Polkit Quick Unlock mechanism
acdfa1f 
This commit and subsequent pull request adds support for Quick Unlock on Linux via Polkit
Polkit allows for authentication of many means, including fingerprint scanning fixing Issue keepassxreboot#5991
Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other mediums easier.
This also fixes keepassxreboot#3337, giving fingerprint reader support to the final major supported platform - Linux.
HexF added a commit to HexF/keepassxc that referenced this issue Jul 21, 2023
@HexF
Add Polkit Quick Unlock mechanism
3f446f9 
This commit and subsequent pull request adds support for Quick Unlock on Linux via Polkit
Polkit allows for authentication of many means, including fingerprint scanning fixing Issue keepassxreboot#5991
Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other mediums easier.
This also fixes keepassxreboot#3337, giving fingerprint reader support to the final major supported platform - Linux.
HexF added a commit to HexF/keepassxc that referenced this issue Aug 23, 2023
@HexF
Add Polkit Quick Unlock mechanism
7097517 
This commit and subsequent pull request adds support for Quick Unlock on Linux via Polkit
Polkit allows for authentication of many means, including fingerprint scanning fixing Issue keepassxreboot#5991
Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other mediums easier.
This also fixes keepassxreboot#3337, giving fingerprint reader support to the final major supported platform - Linux.
@HexF
Copy link
Contributor

HexF commented Aug 24, 2023

My currently open PR to add support for Polkit should get fingerprint support working on any Linux laptop which has support from libfprint and thus Polkit.

@dangarthwaite
Copy link

So ifwhen this gets in - where do I send rewards?

@HexF
Copy link
Contributor

HexF commented Aug 25, 2023

So ifwhen this gets in - where do I send rewards?

Shoot me an email to the address on my GitHub (thomas@hexf.me) and we can work it out there

@mskvsk
Copy link

mskvsk commented Aug 26, 2023

So ifwhen this gets in - where do I send rewards?

Shoot me an email to the address on my GitHub (thomas@hexf.me) and we can work it out there

If you have a crypto wallet you can drop me the address in DM when the PR is approved and I will send stablecoins (or any other major crypto) of your choice.

droidmonkey pushed a commit to HexF/keepassxc that referenced this issue Sep 4, 2023
@HexF @droidmonkey
Add Polkit Quick Unlock Support
853f43b 
Closes keepassxreboot#5991
Closes keepassxreboot#3337 - Support fingerprint readers on Linux

Polkit allows for authentication of many means, including fingerprint scanning. Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other quick unlock strategies easier.

Refactor QuickUnlock to use UUID stored in headers. This is a new feature using the KDBX 4 standard to store a randomly generated UUID in the public headers of the database. This enables identification of KDBX file without relying on path or filename and will eventually support persistent Quick Unlock.
droidmonkey pushed a commit to HexF/keepassxc that referenced this issue Sep 4, 2023
@HexF @droidmonkey
Add Polkit Quick Unlock Support
a5a4c16 
Closes keepassxreboot#5991
Closes keepassxreboot#3337 - Support fingerprint readers on Linux

Polkit allows for authentication of many means, including fingerprint scanning. Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other quick unlock strategies easier.

Refactor QuickUnlock to use UUID stored in headers. This is a new feature using the KDBX 4 standard to store a randomly generated UUID in the public headers of the database. This enables identification of KDBX file without relying on path or filename and will eventually support persistent Quick Unlock.
@dangarthwaite
Copy link

@HexF How's this going?

@HexF
Copy link
Contributor

HexF commented Oct 9, 2023

Waiting on it to get merged

droidmonkey pushed a commit to HexF/keepassxc that referenced this issue Oct 14, 2023
@HexF @droidmonkey
Add Polkit Quick Unlock Support
73597e9 
Closes keepassxreboot#5991
Closes keepassxreboot#3337 - Support fingerprint readers on Linux

Polkit allows for authentication of many means, including fingerprint scanning. Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other quick unlock strategies easier.

Refactor QuickUnlock to use UUID stored in headers. This is a new feature using the KDBX 4 standard to store a randomly generated UUID in the public headers of the database. This enables identification of KDBX file without relying on path or filename and will eventually support persistent Quick Unlock.
pull bot pushed a commit to tigerwill90/keepassxc that referenced this issue Oct 24, 2023
@HexF @pull
Add Polkit Quick Unlock Support
ec87ace 
Closes keepassxreboot#5991
Closes keepassxreboot#3337 - Support fingerprint readers on Linux

Polkit allows for authentication of many means, including fingerprint scanning. Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other quick unlock strategies easier.

Refactor QuickUnlock to use UUID stored in headers. This is a new feature using the KDBX 4 standard to store a randomly generated UUID in the public headers of the database. This enables identification of KDBX file without relying on path or filename and will eventually support persistent Quick Unlock.
@michaelk83 michaelk83 mentioned this issue Nov 3, 2023
Closed
@dangarthwaite
Copy link

So ifwhen this gets in - where do I send rewards?

Shoot me an email to the address on my GitHub (thomas@hexf.me) and we can work it out there

Email sent!

@xade93
Copy link

xade93 commented Feb 12, 2024

Is there any document on how to enable this? I do not find such option on database creation in latest keepassxc (2.7.6-2, archlinux), neither can I find any related material in user document.

@droidmonkey
Copy link
Member

It's not available in a released version yet. You need to use a snapshot build: https://snapshot.keepassxc.org

@PostboxRetinal
Copy link

Seems Polkit is having some issues on latest OpenSUSE Tumbleweed, although fingerprint is already registered, it says Failed to authenticate with Quick Unlock: Polkit authorization failed Probably that's why it is an snapshot version, will wait until a release then.

@droidmonkey
Copy link
Member

Snapshot has nothing to do with this feature functionality. The error message you received points to an issue with your polkit, not keepassxc. Double check that polkit works in general for you.

@bohwaz
Copy link

bohwaz commented Mar 14, 2024

Is this in the 2.7.7 release? I can't see anything in changelog: https://github.com/keepassxreboot/keepassxc/blob/release/2.7.x/CHANGELOG.md

Thanks all for your work :)

@droidmonkey
Copy link
Member

No it is not, we decided to withhold this feature as it isn't equally functional across distros at this time

@bohwaz
Copy link

bohwaz commented Mar 14, 2024

That's sad to hear, but thanks anyway for taking time to reply :) Have a nice day.

@droidmonkey
Copy link
Member

You can always run a snapshot build: https://snapshot.keepassxc.org

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bounty 💰 feature: QuickUnlock new feature platform: Linux
Projects
None yet
Milestone
v2.8.0
Development

No branches or pull requests