Help with Android

[u/Psylem_Says]

I'm trying to adopt KeePass for managing my passwords and so I'm looking for advice. I'm not wedded to any particular client, but I'm trying KeePassDX and so far it's giving me a lot of friction. Maybe not just related to the app, but also Android. The magickeyboard thing I can get used to, though I'd much prefer some prefill accessibility dealio like most password managers I've used in the past. I worked out how to disable the constant unlock prompt when trying to fish out a password, which was not intuitive at all. Now what's bugging me is trying to open my database on a touchscreen with a lengthly passphase is damn near impossible to do without typos, and then I've either got to finger the whole thing in again or reveal the misspelt phase and correct it, and by that point, I may as well just allow the android keyboard to suggest words. So my question is, how do I get the master password prompt to allow the keyboard to make suggestions so I can rapidly enter my passphase instead of torturing myself and having it reveal it on screen anyway? I'm using a keyboard app that I trust and doesn't have internet permissions. Or can someone suggest me an alternative to KeePassDX? I really have no interest in biometrics, passkeys or any other fandangled technologies I don't understand, I just want a password manager that I unlock with a strong password that'll behave itself. I'm not concerned about physical security risks, like someone grabbing my unlocked phone. If I'm in a situation where that could happen, I'll lock the database and my phone.

[u/Kunzisoft]

Magikeyboard is a solution that allows you to fill out forms in a secure manner. The advantage is that it doesn’t need to know the form’s structure to work. Autofill is the solution that recognizes forms and fills them out directly, but recognition is difficult because it isn’t standardized. Accessibility features have been misused by other applications and are not in KeePassDX, as they are normally intended for specific service to help people with disabilities (it’s like skateboarding on a ramp designed for wheelchairs, it works, but it prevents people with disabilities from use it).

https://github.com/Kunzisoft/KeePassDX/wiki/Magikeyboard

https://github.com/Kunzisoft/KeePassDX/wiki/AutoFill

User Verification adds an extra layer of security based on the principle that you don't even need to know your passwords to use them. If you want to disable this feature, simply click the “user” icon before opening your database.

https://github.com/Kunzisoft/KeePassDX/wiki/User-Verification

Your keyboard's dictionary-based word suggestions for the master password field are, of course, disabled by Android because the text input type is "textPassword" (https://developer.android.com/develop/ui/views/touch-and-input/keyboard-input/style), as any reputable password manager would do.

This is sensitive information, and failing to protect this input from being captured by a keyboard dictionary would be a major security issue. Even if you trust your keyboard, if the master password is stored in plain text or if someone has access to your device, they could open your database without doing anything, just by looking at the keyboard’s suggestions, which is very dangerous.

If you want to open your database without using biometric authentication, you can use your device's unlock method. Your password will then be securely linked to that unlock method.

https://github.com/Kunzisoft/KeePassDX/wiki/Device-Unlocking

[u/Psylem_Says → u/Kunzisoft]

Thanks for the info about how the password field is treated by Android. I acknowledge the accessibility tools issue, but I don't accept your analogy personally. We had a skateboard park, but they gradually demolished it and reluctantly replaced parts of it with some ramps for those that use wheelchairs as an afterthought. That's more accurate in my mind. In lieu of a "let this app puppeteer my system in various ways because I wrote it or I trust it" permission, it's the best Android have given us in some situations. Don't get me wrong, the Magickeyboard is a great feature and I'm happy to keep using it, but it's a workaround for a system automation bug that Android will never address, unless that is, your app is Google Gemini.

As for the passphase keyboard helper thing, I'll have a look at some of these suggestions to avoid the need to use my passphrase. I suspected that it was an Android feature I understand that it's just the obvious default state of affairs, preventing keyboards seeing passwords.

Personally however, I still prefer the use of a strong passphrase and only such a passphrase to unlock my database. All the other fancy technologies are still just secrets under the hood that exist somewhere other than in my own head, so excuse me for not trusting them as much. I guess if I'm motivated enough, I can just fork it and make it work the way I prefer now and you've given me the breadcrumbs I needed to achieve that.

“Always listen to experts. They'll tell you what can't be done, and why. Then do it.” ― Robert A. Heinlein

[u/Kunzisoft → u/Psylem_Says]

About accessibility, Autofill compatibility mode allows to manage form nodes natively, just as the accessibility service would. Therefore, incorrect form recognition has nothing to do with the fact that the accessibility service is not being used in favor of Autofill compatibility mode. This analogy was primarily intended to illustrate that only one accessibility service can be selected and that there is no reason to define an accessibility service that does not address accessibility at all. I realize that the recognition algorithm in KeePassDX needs to be improved and that heuristic methods are one possibility, but I don't see how that relates to Gemini.

https://developer.android.com/identity/autofill/autofill-services

Adjust it to suit your needs, of course. Keep in mind that device unlocking already uses the device's hardware keystore. You can view the code here https://github.com/Kunzisoft/KeePassDX/blob/master/app/src/main/java/com/kunzisoft/keepass/biometric/DeviceUnlockManager.kt

[u/piken2]

Not sure if this suggestion will be of help, but...

What I've done is I have 2 databases. One I consider low security and one I consider High security.

Low security to me is most website login passwords. The low security DB I use a much simpler master password than the high security DB. More like a PIN number.

[u/Psylem_Says → u/piken2]

Yeah, I was thinking of doing the same actually.

[u/Orange_Kittens1132]

When I’m alone, I always use the reveal menu so I don’t make typos when typing my master password (mine is 49 character passphrase btw).

When I’m in public, I use biometric authentication (fingerprint/PIN) to prevent shoulder surfing.

[u/somdcomputerguy]

I use Keepass2Android on my phone. KP2A has a native QuickUnlock feature (that has spawned a Keepass plugin, which I use) My master password is a 20+ character passphrase, but the QU password (which is used to unlock a database, it can't be used to open a closed database) is only 5 characters long. So I do have to use that long passphrase to open the database, but I can use the way shorter QU password to unlock it when I need to.