duckduckgo / duckduckgo/Android

[Bug] Sync and Password settings require device security, not available in all devices

Open
#8,365 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs triage
Dominant language
Kotlin
Stars
4.8k
Forks
1.4k
Avg merge
2d 17h
Merged PRs (30d)
170

Description

Describe the bug

I have DDG running successfully and well in two Samsung devices. Sync works fine between them. I have DDG running under the BlueStacks emulator, but when I try to set up either Sync or Password Autofill, it requires a device lock security enabled. At this time, there is no known method to set up PIN, Pattern, or Password protection under BlueStacks.

Entering the Sync code from the Samsung's to share their DDG with BlueStacks does not work, as it still requires the device lock.

I had this same problem under Android Studio and Genesys emulations.

There are other users experiencing similar issues with DDG and actual Android devices, due to manufacturer security specs not matching something or another that the browser wants.

There are many available FOSS and open-source 2FA methods for providing the same level of authentication. It seems like incorporating a 2FA authorization method should provide a similar level of security and security method. MEGA.nz uses 2FA, as do many, many other companies.

Another alternative is for the BlueStacks DDG browser to send an authorization code from the device providing the QR code (in my case, the Samsung phone).

And yes, many, many, many people have been hounding BlueStacks to enable PIN protection specifically because of DDG, banking apps and more.

My current workaround is to clear cache, clear data, and re-import bookmarks exported from Samsungs. There is no work around for exporting password autofill capability.

How to Reproduce

Run DDG on BlueStacks and attempt to enable either Sync or Password Autofill. You're prompted to set security on your device. It does not open anything else. When I tried entering the sharing code (text alternative to the QR code), it just gives the same prompt.

Expected behavior

To at least be able to sync my bookmarks.

Environment
- DDG App Version: 5.276.0
- Device: BlueStacks Emulator App Player 5.22.104.1008, Android 11
- OS: Android 11, rel date 8 Sep 2020, API 30, 
Build ID: TP1A.220624.014, 
Build Time: Tue Jun 21 19:06:33 PDT 2022, 
Fingerprint: samsung/b0qxxx/b0q:11/TP1A.220624.014/S908EXXS2BWA2:user/release-keys
Board: taro
Hardware: qcom
Boot Loader: unknown
CPU Model: 12th Gen Intel(R) Core(TM) i7-12700
Cores: 4
Actual RAM: 8 GB
Physical Available RAM: 7966 MB
ABI: x86_64
Internal Storage Overview 
Used :27.84 GB
Free :98.03 GB
Total :125.87 GB

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the device-security prompt for Sync and Password Autofill on BlueStacks, Android Studio, or Genymotion as described. Start by tracing the entry points for those setup flows and how the sharing code is handled. The expected result and acceptable security alternative need to be defined before implementation; done should include a verified path for bookmark sync and a clear decision about password autofill.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.