5 ms·

How does one realistically type in the master password on a phone keyboard [1]? A secure password would be like 20 characters long with a mix of alphanumeric an

How does one realistically type in the master password on a phone keyboard [1]? A secure password would be like 20 characters long with a mix of alphanumeric and special characters. [1] Do these password managers even use their own keyboard, or rely on whatever insecure keyboard is installed on the mobile OS?

ChrisRR 6y ago
What's wrong with typing in 20 characters on a phone keyboard? My password is longer than that and I don't have an issue Alternatively you can use fingerprint unlock
- abdullahkhalids 6y ago
  Because it takes a long time. On the rare occasion I log into something on my phone, it takes almost a minute to type in the random passwords that Keepassxc on my computer generates. Fingerprint authentication will work though.
  - NamTaf 6y ago
    Once you're logged in, just copy/paste the password? You only need to type out your master password manually. Am I misunderstanding the issue?
    - distances 6y ago
      On Android you should not copy/paste as all apps can read the clipboard. Use either a keyboard that comes with the password manager, or system auto-fill support that gets the values from the manager. Both modes are supported at least by Keepass2Android.
Kaze404 6y ago
You can use a fingerprint to authenticate on Android.
- littlecranky67 6y ago
  The problem is, most if not all Android devices do not provide some secure-enclave like architecture where the crypto key to unlock is secured by hardware design, but rather simple software solutions where the master unlock key resides in memory. So if you happen to have any malware combined with a security exploit, they might access your vault without requiring a fingerprint. I do not trust any android device with my vault for exactly that reason.
  - veeti 6y ago
    This is just completely incorrect. https://developer.android.com/training/articles/keystore https://developer.android.com/training/articles/keystore
    - littlecranky67 6y ago
      It says that secure enclave is optional. Do you know of any vendor that ship hardware based secure enclave? AFAIK there are no major vendors that actually do this, so this is just operating system level protection, not hardware based.
  - gruez 6y ago
    >The problem is, most if not all Android devices do not provide some secure-enclave like architecture where the crypto key to unlock is secured by hardware design, but rather simple software solutions where the master unlock key resides in memory Why is this relevant? Even if you do have secure enclave, if you can do arbitrary memory reads a malicious app can simply wait until your database is unlocked and dump your database when it's unencrypted in memory. Moreover, if you have some sort of exploit that gives you operating system level access, you can simply impersonate the password manager app (eg. changing uids, or patching the executable in-memory) and get the secure enclave to do the decryption.
    - littlecranky67 6y ago
      "wait" means run in the background. Once more this is not possible on iOS.
Flockster 6y ago
The other question would be, how do you handle this without a password manager? And is this a known problem of Android, that there are keyboards that can log your keys?
- approxim8ion 6y ago
  I use Simple Keyboard (based on the AOSP keyboard), which is a very basic FOSS keyboard with no logging, suggestions or any of that. Other good options with more features most people want are OpenBoard and AnySoft. Hacker's Keyboard is a decent one too.
  - Tijdreiziger 6y ago
    Related question: Does anyone have any suggestions for an OSS keyboard with suggestions and (good) swipe functionality? I currently use Gboard and it's great, but, well, it's a Google product.
    - approxim8ion 6y ago
      The FOSS keyboard with the best swipe functionality is AnySoft. But it is miles behind SwiftKey and Gboard in my experience. With some patience and training it is serviceable though.
      - Fnoord 6y ago
        This is why I stick with SwiftKey. Nothing beats it, and although it got bought by Microsoft, they did not Frankenstein it. If you look for the app start with the 'M' of Microsoft though.
        approxim8ion 6y ago
        Yeah, I think SwiftKey with a firewall blocking outgoing requests is the most feature-rich keyboard experience on Android which isn't outrageously privacy invasive Personally, I still like using Simple Keyboard. It's the complete opposite of something like Swiftkey. does one thing and does it well, is super light too.
approxim8ion 6y ago
My MP is more than 40 chars long, but it's not really a chore to type it in considering we are texting much longer strings than that literally all the time. Many of them support biometric authentication using Android's API. Also, to enter the master password, all of them use whatever keyboard is installed, some of them send a message to them to work in "incognito mode" for what good that it. That said, for Keepass2Android and KeePassDX, they offer their own keyboard to enter secure credentials on sites you log into once your password manager is unlocked. That allows you to circumvent the system clipboard entirely, which is a major attack surface. Some apps also support the android autofill feature.
- randallsquared 6y ago
  > [...] considering we are texting much longer strings than that literally all the time. Without typos? Typing a tweet or text message into your phone, your thumbs hit somewhere near the right characters and your phone figures out what words you meant as you type. The uncorrected characters are often gibberish. This is a very different use case from having to get the case and special characters right for a 40 character password.
  - approxim8ion 6y ago
    Without typos. I use a keyboard that has no predictive features, swiping, or suggestions. But I understand your point. Personally I found training myself to type accurately worth it but most people may not.
werdnapk 6y ago
1Password allows you to use your fingerprint on Android and I'd assume TouchID or FaceID on iOS as well.
- wdb 6y ago
  Yes, it does, TouchID works fine on my iPad and macOS devices :)
ComodoHacker 6y ago
Keepass2Android can install it's own keyboard.
rainbowzootsuit 6y ago
I use diceware to make a master password that's reasonable to type on a device. Bitwarden is able to produce diceware style passwords too. https://theworld.com/~reinhold/diceware.html https://theworld.com/~reinhold/diceware.html
- deleted 6y ago
  [deleted]

ChrisRR 6y ago

What's wrong with typing in 20 characters on a phone keyboard? My password is longer than that and I don't have an issue Alternatively you can use fingerprint unlock

abdullahkhalids 6y ago
Because it takes a long time. On the rare occasion I log into something on my phone, it takes almost a minute to type in the random passwords that Keepassxc on my computer generates. Fingerprint authentication will work though.
- NamTaf 6y ago
  Once you're logged in, just copy/paste the password? You only need to type out your master password manually. Am I misunderstanding the issue?
  - distances 6y ago
    On Android you should not copy/paste as all apps can read the clipboard. Use either a keyboard that comes with the password manager, or system auto-fill support that gets the values from the manager. Both modes are supported at least by Keepass2Android.

Kaze404 6y ago

You can use a fingerprint to authenticate on Android.

littlecranky67 6y ago
The problem is, most if not all Android devices do not provide some secure-enclave like architecture where the crypto key to unlock is secured by hardware design, but rather simple software solutions where the master unlock key resides in memory. So if you happen to have any malware combined with a security exploit, they might access your vault without requiring a fingerprint. I do not trust any android device with my vault for exactly that reason.
- veeti 6y ago
  This is just completely incorrect. https://developer.android.com/training/articles/keystore https://developer.android.com/training/articles/keystore
  - littlecranky67 6y ago
    It says that secure enclave is optional. Do you know of any vendor that ship hardware based secure enclave? AFAIK there are no major vendors that actually do this, so this is just operating system level protection, not hardware based.
- gruez 6y ago
  >The problem is, most if not all Android devices do not provide some secure-enclave like architecture where the crypto key to unlock is secured by hardware design, but rather simple software solutions where the master unlock key resides in memory Why is this relevant? Even if you do have secure enclave, if you can do arbitrary memory reads a malicious app can simply wait until your database is unlocked and dump your database when it's unencrypted in memory. Moreover, if you have some sort of exploit that gives you operating system level access, you can simply impersonate the password manager app (eg. changing uids, or patching the executable in-memory) and get the secure enclave to do the decryption.
  - littlecranky67 6y ago
    "wait" means run in the background. Once more this is not possible on iOS.

Flockster 6y ago

The other question would be, how do you handle this without a password manager? And is this a known problem of Android, that there are keyboards that can log your keys?

approxim8ion 6y ago
I use Simple Keyboard (based on the AOSP keyboard), which is a very basic FOSS keyboard with no logging, suggestions or any of that. Other good options with more features most people want are OpenBoard and AnySoft. Hacker's Keyboard is a decent one too.
- Tijdreiziger 6y ago
  Related question: Does anyone have any suggestions for an OSS keyboard with suggestions and (good) swipe functionality? I currently use Gboard and it's great, but, well, it's a Google product.
  - approxim8ion 6y ago
    The FOSS keyboard with the best swipe functionality is AnySoft. But it is miles behind SwiftKey and Gboard in my experience. With some patience and training it is serviceable though.
    - Fnoord 6y ago
      This is why I stick with SwiftKey. Nothing beats it, and although it got bought by Microsoft, they did not Frankenstein it. If you look for the app start with the 'M' of Microsoft though.
      - approxim8ion 6y ago
        Yeah, I think SwiftKey with a firewall blocking outgoing requests is the most feature-rich keyboard experience on Android which isn't outrageously privacy invasive Personally, I still like using Simple Keyboard. It's the complete opposite of something like Swiftkey. does one thing and does it well, is super light too.

approxim8ion 6y ago

My MP is more than 40 chars long, but it's not really a chore to type it in considering we are texting much longer strings than that literally all the time. Many of them support biometric authentication using Android's API. Also, to enter the master password, all of them use whatever keyboard is installed, some of them send a message to them to work in "incognito mode" for what good that it. That said, for Keepass2Android and KeePassDX, they offer their own keyboard to enter secure credentials on sites you log into once your password manager is unlocked. That allows you to circumvent the system clipboard entirely, which is a major attack surface. Some apps also support the android autofill feature.

randallsquared 6y ago
> [...] considering we are texting much longer strings than that literally all the time. Without typos? Typing a tweet or text message into your phone, your thumbs hit somewhere near the right characters and your phone figures out what words you meant as you type. The uncorrected characters are often gibberish. This is a very different use case from having to get the case and special characters right for a 40 character password.
- approxim8ion 6y ago
  Without typos. I use a keyboard that has no predictive features, swiping, or suggestions. But I understand your point. Personally I found training myself to type accurately worth it but most people may not.

werdnapk 6y ago

1Password allows you to use your fingerprint on Android and I'd assume TouchID or FaceID on iOS as well.

wdb 6y ago
Yes, it does, TouchID works fine on my iPad and macOS devices :)

ComodoHacker 6y ago

Keepass2Android can install it's own keyboard.

rainbowzootsuit 6y ago

I use diceware to make a master password that's reasonable to type on a device. Bitwarden is able to produce diceware style passwords too. https://theworld.com/~reinhold/diceware.html https://theworld.com/~reinhold/diceware.html

deleted 6y ago
[deleted]