IOS and Android app using flutter

[kishaningithub]

As flutter has reached its 1.0 stage. Do you have plans to make an official ios and android app using the same?

I am thinking of creating a library to read and write kdbx files in dart and then create ios and android apps using the flutter framework on top of it. What do you think ?

[droidmonkey]

We have no plans to produce a mobile app. We are discussing the possibility of creating a "libkdbx" from our core code, but that would be in C++ using Qt.

[kishaningithub]

When there is an official browser extension why not a hybrid native app ? I personally feel this is the only missing link affecting the widespread adoption of keeppassxc.

[vnagendra]

@droidmonkey - what is the status of this? https://github.com/keepassxreboot/keepassxc-specs. Maybe the core team isn't currently planning to develop App - no worries, I am sure someone in the community would be interested.. Just trying to figure out what it would take (I am interested)

I can see an MVP being

1. Support for Cloud Files (kdb files on iCloud or similar for Android)
2. Support for TouchId (some kind of biometric Id, even though I am saying TouchId)
3. Decent UI/UX, to see/search/copy

I am purposely not including generation as that would require hopping into C++ land, which IMO Flutter isn't all that great with.

@kishaningithub - I'd be interested in collaborating...

[kishaningithub]

In native open source app space, These are the ones i could find

For Android,

• Keepass2Android
• KeePass DX

For iOS,

• MiniKeePass

I personally use MiniKeePass as i am using ios.

@vnagendra This has support for

• Touch id
• Integration with apple keychain.

both of these features are "opt-in"

I personally thought an hybrid app with an inclusion into KeePassXC organization would unify the community.

[droidmonkey]

This would take a separate team (one with mobile experience and the toolchains and testing gear necessary) to adopt the product. It would only be truly "ground breaking" if you are running the libkdbx in native code to gain a tremendous speed boost over Java/Kotlin/Dart/C#. If an MVP is developed with bindings to a minimal libkdbx we could adopt that into our GitHub organization and let a team loose on it. The current native apps certainly serve their purpose and do it well. I would personally love to see a "KeePassXC" app in the Play Store at the very least.

@vnagendra that is currently being worked on by @phoerious. I am pretty sure he is going to be finalizing it by the new year.

[phoerious]

I will have some time over the holidays I think (hope). :-)

[vnagendra]

@droidmonkey - Thanks. Just to make sure I understood your references correctly

that is currently being worked on by @phoerious

that here refers to

a minimal libkdbx

and not the MVP?

I am not entirely convinced that a speed boost should be the goal here. I am not saying that's not important, having a unified c++ (or whatever) code is good from a security standpoint - less things to go wrong, whether it's the implementation or the underlying libraries that support crypto.

While I don't profess a lot of experience in the Dart or Kotlin crypto toolkits - the idea of all the "front ends" (like Apps, MacOs or whatever) having their own crypto implementation - isn't appealing.

However if we were to go down this path with Flutter + libkdbx (which is where the thread started) -- we will need to wait for this - flutter/flutter#7053

[phoerious]

I think that referred to the keepassxc-specs repository.

[vnagendra]

hahaha. Perfect. I wasn't even close :)

[droidmonkey]

They really 1.0'd flutter without native code bindings? That's a core feature of Android SDK.

[vnagendra]

Now we are definitely off chasing bunnies 😃

Yes, Flutter 1.0 doesn't have FFI - but it has native bindings. When it's cross platform, "Native" takes a different meaning I suppose. Either way for any of my use cases -- Flutter works beautifully.

This issue is talking about FFI, which is calling C/C++ code directly, not Android/iOS native Java/Swift code directly. The latter is supported today.

[droidmonkey]

What does FFI stand for? I never seen that acronym before. By "native" I am referring to code compiled down to machine language (i.e., not interpreted or byte code). Java is not native, it requires a virtual machine to interpret the byte code into machine code (Just In Time compilation).

[vnagendra]

FFI == Foreign function interface

Basically in the Flutter world you can "talk to" a native thing -- the thing typically is a ViewController or Activity. This happens over what is called Channels.

So in the Android world it's a little wonky -- but let's take the example of an iOS App. The Swift code (or Objective C) is generally compiled to binary. In the Android world - it's an APK, which is in byte code.

Typically in a mobile App, especially in a cross-platform thing like Flutter -- when developers want to talk to native -- they are talking about a ViewController, Activity or somesuch. If you are coming from a C world though - you'll be thinking C libraries of some sort. In Java land this is JNI (I believe) -- I try to stay away from Java land, so my acronyms may be tiny bit off. In Swift this is just an external lib (either statically or dynamically linked) in your App (added as part of building the App).

Flutter currently supports calling a ViewController, Activity etc., You could in theory currently just go through Java code to C++ land. This requires a lot of ceremony and magic incantations.

The issue (on Flutter that I linked to) is talking about directly without ceremony calling C++ code (or some other object library). That is not currently supported.

When that is supported, we can figure out a plan for supporting the C++ code provided by KeepassXC rather than writing our own code to do the crypto parts. I am happy to pitch in and help out.

[droidmonkey]

Cool thanks for the explanation. I have a good amount of Android app experience using Java and then Kotlin. I don't want to learn Dart just yet so I am holding off on Flutter atm.

[droidmonkey]

So I took the dive into Flutter (and Dart) and actually enjoyed it. Very easy to use. I absolutely hate the endless closures and indentations though. Also, it looks like Flutter has pegged Q1FY19 to introduce the FFI capability.

[andreadelfante]

Hi, is there any news about using flutter for a cross-platform mobile keepassxc version?

[droidmonkey]

Not going to happen anytime soon. There are plenty of great Android apps and one actively developed iOS app that is fully compatible.

[vnagendra]

Well it couldn’t have happened until now anyway. Finally looks like Dart 2.5 now supports FFI - so any projects that may want to do this can finally start. It was also released today (it appears)

[SVilgelm]

one actively developed iOS app that is fully compatible.

@droidmonkey Could you tell a name of that app? I found only strongbox.

[droidmonkey]

Strongbox is the recommendation.

[SVilgelm]

Strongbox is the recommendation.

Thanks

[keepassium]

Strongbox is the recommendation.

@droidmonkey, I might regret asking this in public, but is there a reason why KeePassXC's endorsement omits KeePassium?

[droidmonkey]

Maturity mainly, tbh

[keepassium]

Maturity mainly, tbh

Fair enough, thanks for the response.

[OLLI-S]

What is annoying in KeePass and KeePassXC is that there are no official mobile apps.
I am forced to use apps from 3rd party developers (like KeePass2Android) that look and behave different than KeePass/KeePassXC and that have slightly other features than KeePass/KeePassXC.
This is the main argument why some of my colleagues use Bitwarden, LastPass, or 1Password.

I fear that this is too much work for this project and that this idea gets rejected.
But I suggest it anyways, because it is important for a good usability.

[OLLI-S]

@droidmonkey How much money must be donated for this feature request?
If you really think about creating an Android app, then I would donate 50 Dollar for this.
But I will make my donation later, when you plan to start with this feature!

[droidmonkey]

This feature request would cost about $15,000 (minimum) if you want to be realistic. 😄

[OLLI-S]

This feature request would cost about $15,000 (minimum) if you want to be realistic. 😄

😱 SHOCK

[ArminWeb]

I also want to have an Android app

[OLLI-S]

@phoerious suggested in a chat that maybe a cooperation with Keepass2Android (we use the Keepass2Android app with a KeePassXC rebrandung).
This sounds reasonable and avoids an implementation of an app that is already existing.
So I posted his idea here.

[phoerious]

Careful, before we spread rumors here. That is what I see as the most probable path something like this would happen. It does not mean in any way that the KP2A maintainer is on board with this, nor have we even asked him.

[OLLI-S]

@phoerious Sorry if my posting was misunderstood (or mot written correctly).
I should have written that a cooperation might be an idea.

[phoerious]

It's alright. I just don't want somebody to read this, take it as a fact, and write a blog article about it or so. This is a rather large project after all.

[phoerious]

We do not have any immediate plans or capacity for developing separate mobile apps at the moment. The development of a simple mobile UI for a libkdbx may become simpler in the future, though: #5717