Android Accessibility Service about mobile HOT 36 CLOSED

This has now been completed and available on the play store. See blog post for full details: https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill-a0b582ada0e9#.gv2t8a8dt

from mobile.

@bcallaars It would be optional since you have to manually enable the accessibility service in settings.

from mobile.

@lucacome 2FA is now available again with the latest alpha build.

from mobile.

@sreich @Primokorn I just pushed build 437 to the beta slot. Please give that a try for a possible fix.

from mobile.

Can we have this optional please, I personally don't like it auto-auto-filled.

from mobile.

This would be amazingly helpful if it didn't require a secondary keyboard to switch to, like 1Password requires.

from mobile.

I am doing some research on this issue and am looking at the Keepass2Android implementation. I see that it uses system notifications to give me the ability to copy the username/password to clipboard whenever it detects a password field on screen, but I do not see where it pops up an overlay that lists my logins to pick from and actually autofill. Am I missing something? Anyone familiar with the Keepass2Android app?

from mobile.

Any updates on time frame for this feature? Deal breaker for me until it's implemented. Hope to see it soon. Thanks

from mobile.

See my last comment. I am still looking for examples of a good implementation (other than LastPass). Some of the work has already been started.

from mobile.

Try the (sticky password) application. It has a floating option that allows you to choose between your accounts.

from mobile.

Another good application is (Dashlane Password Manager)

from mobile.

I have autofill working well in the following browsers:

• Chrome
• Android
• Brave
• Opera

If anyone is interested in helping beta testing the next release of the mobile app with the autofill service, let me know. You can email me on the website using the contact form or join our gitter chatroom here: https://gitter.im/bitwarden/Lobby

from mobile.

For those who wish to beta test autofill, attached is a beta build APK you can download and install. Please uninstall existing versions of bitwarden before installing this one. Also note that you shouldn't continue to use this version and should uninstall it and re-download from the play store once done testing.

Download here: [REMOVED - See google play link below for testing now]

from mobile.

I've set up alpha testing on the Google play store now for this. You can get the nightly build for this here: https://play.google.com/apps/testing/com.x8bit.bitwarden

The plan is to have autofill released at some point next week.

from mobile.

Can't seem to login with the alpha...

from mobile.

@lucacome The alpha is still in being developed with some changes to the authentication process, so if you have 2FA turned on, you wont be able to log in currently. If you want to test you'll need to disable 2FA for now. Do you have 2FA turned on for your account?

from mobile.

Also, those who may want to test this outside of the play store, you can always download the latest APK attached to our CI builds here: https://ci.appveyor.com/project/bitwarden/mobile/build/artifacts

from mobile.

Video of Bitwarden 1.2.1
As you can see, the notification is automatically removed as soon as I open the notification panel or I open the keyboard.
Android 7.1.1 - OnePlus 3T

from mobile.

Another user reported the same thing when he had the lastpass auto fill service turned on still. When he turned off lastpass it started working correctly. I wasn't able to reproduce it though. Do you happen to have that on? Investigating....

from mobile.

I have the same issue. I turned off lastpass service and turned on bitwarden service in accessibility settings, but i have never seen the bitwarden auto-fill notification.
Bitwarden 1.2.1 (436)
Samsung Galaxy S7 Edge

from mobile.

@kwiky what android version?

from mobile.

@kspearrin 6.0.1

from mobile.

@kspearrin sorry, it works on android apps and chrome, but not with firefox.
Sorry because lastpass always display his notification, and bitwarden notification is only displayed when login fields is detected. This is why i thought it doesn't works

from mobile.

This is maybe why lastpass always display this notification, because of apps like firefox ?

from mobile.

Firefox browser is not supported at this time.

from mobile.

LastPass always displaying the notification is a feature. It's an option in its settings and it proves most useful because the auto detection is definitely not foolproof, even for LastPass.

Disabling LastPass service seemed to have worked around bitwarden hiding it's notification before you can hit it, but obviously isn't a fix.

from mobile.

@kspearrin no changes after switching off Lastpass accessibility service.

from mobile.

@Primokorn

The way the accessibility service works is that it receives events every time something changes on your screen. That can be opening a new screen, focusing a textbox, opening the notification center, scrolling a web page, etc. When these events occur I get certain information such as which app is causing the event to occur, what text fields are on the screen, etc.

The logic every time these events are received is:

1. Is this a com.android.systemui event?
   • Yes? Return immediately. Nothing to do.
   • No? Continue to step 2.
2. Does the event's window "context" have any password fields on it?
   • Yes? Show a notification.
   • No? Dismiss any previous notifications.

Opening the notification center and keyboard are suppose to be com.android.systemui events, so they should be stopped (returned) from dismissing the notification. Obviously that doesn't seem to be happening with your device. Therefore it is going to step 2 in which it doesn't find any password field on the event's "context". In this case the context is likely your keyboard or notification center, not the information on the screen "behind" it.

Any idea why those wouldn't be classified as com.android.systemui events? Are you using some custom keyboard or something that might be classified differently?

Are you available at some time to help me debug the issue in live chat or anything? It's very difficult to try to resolve issues like this that I can't reproduce but are obviously affecting people. All reports I have heard about this so far have been on Android 7.1 which may also be a common denominator. Do you have any other devices you could test it out on to see if the issue persists?

from mobile.

On my lunch break, but I'm using GBoard (Google keyboard). I won't be able to help for a while so perhaps someone else can sooner.

from mobile.

@kspearrin this new update fixes the notification issue. Thanks. I'm on 445, though.

I tested with the mobile app of my mobile carrier (Bouygues Telecom).
In my vault my logins are stored this way:

Name: Bouygues My Account
Website: bouyguestelecom.fr
Username: my phone number
Password: ••••••••••••••••••••

While opening the app (package name: fr.bouyguestelecom.ecm.android) bitwarden is looking for ecm.android.
The screen 'logins for ecm.android' is loading again and again and bitwarden doesn't find anything.

from mobile.

Awesome. Thanks to @sreich I was able to somewhat reproduce the issue using gboard.

This is because apps are searched for differently that websites.

It's looking for a login with the explicit uri "androidapp://packagename" which is different than the web address.

I could start searching it for the reverse domain, but that could potentially be exploited since a person can give their app whatever reverse domain package name that they want. For example, I can call my package "com.google.bitwarden" and get it to list your google logins for you to auto fill into my app. Not really sure the best way to handle that.

from mobile.

There is a new feature in the web vault that lets you configure equivalent domains. So you could also associate androidapp://packagename with a Website domain and it will then suggest it to you when searching.

from mobile.

I'm pretty happy with the latest build. Unless anyone has any objections, I'll plan on pushing to production tomorrow some time.

from mobile.

Anyone have an Android 5.x device? I haven't been able to test that version and I am curious if the populating of text fields during the autofill process works or not. It doesn't on 4.4 so I show an alternate flow that offers copy/paste instead. Wondering if I need to do that for 5.x as well or not. 6.x and 7.x are tested and good to go.

from mobile.

I am doing some research on this issue and am looking at the Keepass2Android implementation. I see that it uses system notifications to give me the ability to copy the username/password to clipboard whenever it detects a password field on screen, but I do not see where it pops up an overlay that lists my logins to pick from and actually autofill. Am I missing something? Anyone familiar with the Keepass2Android app?

I've been using Keepass2Android for awhile and in order to search for sites, you switch to their keyboard and then click the little button with an android picture on it which brings up a menu asking to either select an entry or use the option presented.

Personally I greatly prefer the keyboard over the accessibility option due to accessibility triggering,

your device won't use your screen lock to enhance data encryption.

from mobile.

That's Android being misleading, see here:

https://lastpass.com/support.php?cmd=showfaq&id=8936

Just enable it then set (even if it was set before) your passphrase. It will warn you that accessibility services won't be able to startup.

I don't think this happens at all in Android 7 because it uses per file encryption and apps that want to can be activated pre boot in a separate storage area. Like an alarm clock (so it can wake you up even before you put in your password, for instance.

But anyway the idea was that eg blind users would want accessibility services to be available at startup.

So yeah, it's perfectly fine and secure to use that assuming you do that extra step, as far as I know.

from mobile.