microG doesn't prompt user for identity verification before allowing Google Account sign in.
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 14.6k
- Forks
- 3.2k
- Avg merge
- 12d 11h
- Merged PRs (30d)
- 4
Description
**Describe the bug**
When adding a Google Account in microG on a device that has a screen lock set (PIN, Pattern, Password, etc), microG allows the user to add a Google Account and goes to the sign in page without asking for user authorization (entering screen lock).
**To Reproduce**
Steps to reproduce the behavior:
1. Ensure that a screen lock is set (PIN, Pattern, Password, etc)
2. Open microG Settings
3. Tap "Google Accounts"
4. Tap "Add Google account"
microG then goes to the Google Account sign in page without prompting user for identity verification (entering screen lock).
**Expected behavior**
microG tells the system to show a screen to prompt user to confirm their screen lock before going to the Google Account sign in screen.
**Screenshots**
Not applicable
**System**
Android Version: 16
Custom ROM: LineageOS 23.0
**Additional context**
On a device that has normal Google Play Services, the system asks the user to confirm identity by entering their screen lock or using biometrics before allowing the user to go to sign in page. This behavior doesn't happen on microG, and it should be added for security to ensure the device owner is who's adding a Google account.
I believe adding it should be easy, but sadly I don't have knowledge to implement it myself.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the microG Settings flow for Google Accounts and the “Add Google account” entry point, then trace how it opens the sign-in page on Android. Compare this with the system identity-verification behavior described in the issue. Done means a configured screen lock or biometric prompt appears before the account sign-in screen.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- authentication, mobile, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100