Kunzisoft / Kunzisoft/KeePassDX
Fake the length for values in non-editable password fields when masked/hidden
- Dominant language
- Kotlin
- Stars
- 7.3k
- Forks
- 401
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 1
Description
**Issue**
When a non-editable view of a password (e.g. in an entry's protected field) is masked/hidden, currently, the number of masked characters accurately corresponds to the length of the field. In some cases, such as for words from word lists provided by Seedvault or Nextcloud end-to-end encryption recovery phrases, the length alone provides useful information for a shoulder surfer, because there's a much more limited pool of possibilities based on length.
For example, when viewing a password entry with protected fields:
Word 01
•••
Word 02
•••••••••
Word 03
•••
Word 04
••••
[...]
Where the possible words are known ahead of time, knowing the length of a word narrows the scope considerably.
**Describe the solution you'd like**
Regardless of the view-only password field's values, the masked passwords should show a consistent (false) number of password characters, e.g. 8 characters. When editing/entering a password, it's obviously appropriate to keep the behavior as-is, but when the passwords are not editable, the length should stay consistent when masked/hidden and not correspond to the actual length of the password.
For example, when viewing a password entry with protected fields:
Word 01
••••••••
Word 02
••••••••
Word 03
••••••••
Word 04
••••••••
[....]
From what I recall, most other apps I've used do this (fake the number of password characters until shown), but I can't think of any examples currently.
Contributor guide
Research direction
Start by locating the Android UI entry point that renders masked values for non-editable password fields, then compare it with the editable or password-entry behavior. Verify the protected-field view shows the same fixed masked length for values of different lengths while editing remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile-dev, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100