microg / microg/GmsCore

microG doesn't prompt user for identity verification before allowing Google Account sign in.

Open
#3,412 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

👥 Google Accounts enhancement
Dominant language
Java
Stars
14.6k
Forks
3.2k
Avg merge
12d 11h
Merged PRs (30d)
4

Description

**Describe the bug**
When adding a Google Account in microG on a device that has a screen lock set (PIN, Pattern, Password, etc), microG allows the user to add a Google Account and goes to the sign in page without asking for user authorization (entering screen lock).

**To Reproduce**
Steps to reproduce the behavior:
1. Ensure that a screen lock is set (PIN, Pattern, Password, etc)
2. Open microG Settings
3. Tap "Google Accounts"
4. Tap "Add Google account"

microG then goes to the Google Account sign in page without prompting user for identity verification (entering screen lock).

**Expected behavior**
microG tells the system to show a screen to prompt user to confirm their screen lock before going to the Google Account sign in screen.

**Screenshots**
Not applicable

**System**
Android Version: 16
Custom ROM: LineageOS 23.0

**Additional context**
On a device that has normal Google Play Services, the system asks the user to confirm identity by entering their screen lock or using biometrics before allowing the user to go to sign in page. This behavior doesn't happen on microG, and it should be added for security to ensure the device owner is who's adding a Google account.

I believe adding it should be easy, but sadly I don't have knowledge to implement it myself.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the microG Settings flow for Google Accounts and the “Add Google account” entry point, then trace how it opens the sign-in page on Android. Compare this with the system identity-verification behavior described in the issue. Done means a configured screen lock or biometric prompt appears before the account sign-in screen.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
authentication, mobile, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.