Kunzisoft / Kunzisoft/KeePassDX

Fake the length for values in non-editable password fields when masked/hidden

Open
#1,097 3 comments 0 reactions 0 assignees View on GitHub
feature
Dominant language
Kotlin
Stars
7.3k
Forks
401
Avg merge
2d 10h
Merged PRs (30d)
1

Description

**Issue**
When a non-editable view of a password (e.g. in an entry's protected field) is masked/hidden, currently, the number of masked characters accurately corresponds to the length of the field. In some cases, such as for words from word lists provided by Seedvault or Nextcloud end-to-end encryption recovery phrases, the length alone provides useful information for a shoulder surfer, because there's a much more limited pool of possibilities based on length.

For example, when viewing a password entry with protected fields:
Word 01
•••
Word 02
•••••••••
Word 03
•••
Word 04
••••
[...]

Where the possible words are known ahead of time, knowing the length of a word narrows the scope considerably.

**Describe the solution you'd like**
Regardless of the view-only password field's values, the masked passwords should show a consistent (false) number of password characters, e.g. 8 characters. When editing/entering a password, it's obviously appropriate to keep the behavior as-is, but when the passwords are not editable, the length should stay consistent when masked/hidden and not correspond to the actual length of the password.

For example, when viewing a password entry with protected fields:
Word 01
••••••••
Word 02
••••••••
Word 03
••••••••
Word 04
••••••••
[....]

From what I recall, most other apps I've used do this (fake the number of password characters until shown), but I can't think of any examples currently.

Contributor guide

Open the contributing guide

Research direction

Start by locating the Android UI entry point that renders masked values for non-editable password fields, then compare it with the editable or password-entry behavior. Verify the protected-field view shows the same fixed masked length for values of different lengths while editing remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
mobile-dev, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.