Fix keepassxc-browser password entropy display #3107
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
varjolintu
approved these changes
May 26, 2019
There was a problem hiding this comment.
KeePassXC-Browser side PR here: keepassxreboot/keepassxc-browser#552
Pass correct entropy amount to keepassxc-browser instead of amount of bits in password/passphrase. Rename json key from "login" to "entropy" (keeping "login" key as well for backwards compatibility). Also make some changes to entropy calculation methods: - Rename PassphraseGenerator::calculateEntropy to getCurrentEntropy - Rename PasswordGenerator::calculateEntropy to estimateEntropy - Implement PasswordGenerator::getCurrentEntropy
droidmonkey
force-pushed
the
hotfix/fix-browser-entropy-estimate
branch
from
aebdbbe to
4d68664
Compare
* Removed unused passwordGenerator estimate function * Aligned function names between password and passphrase generator
droidmonkey
force-pushed
the
hotfix/fix-browser-entropy-estimate
branch
from
4d68664 to
4fbd459
Compare
droidmonkey
approved these changes
Jun 19, 2019
droidmonkey
changed the title
phoerious
added a commit
that referenced
this pull request
Oct 26, 2019
Added - Add 'Paper Backup' aka 'Export to HTML file' to the 'Database' menu [[#3277](#3277)] - Add statistics panel with information about the database (number of entries, number of unique passwords, etc.) to the Database Settings dialog [[#2034](#2034)] - Add offline user manual accessible via the 'Help' menu [[#3274](#3274)] - Add support for importing 1Password OpVault files [[#2292](#2292)] - Implement Freedesktop.org secret storage DBus protocol so that KeePassXC can be used as a vault service by libsecret [[#2726](#2726)] - Add support for OnlyKey as an alternative to YubiKeys (requires yubikey-personalization >= 1.20.0) [[#3352](#3352)] - Add group sorting feature [[#3282](#3282)] - Add feature to download favicons for all entries at once [[#3169](#3169)] - Add word case option to passphrase generator [[#3172](#3172)] - Add support for RFC6238-compliant TOTP hashes [[#2972](#2972)] - Add UNIX man page for main program [[#3665](#3665)] - Add 'Monospaced font' option to the notes field [[#3321](#3321)] - Add support for key files in auto open [[#3504](#3504)] - Add search field for filtering entries in Auto-Type dialog [[#2955](#2955)] - Complete usernames based on known usernames from other entries [[#3300](#3300)] - Parse hyperlinks in the notes field of the entry preview pane [[#3596](#3596)] - Allow abbreviation of field names in entry search [[#3440](#3440)] - Allow setting group icons recursively [[#3273](#3273)] - Add copy context menu for username and password in Auto-Type dialog [[#3038](#3038)] - Drop to background after copying a password to the clipboard [[#3253](#3253)] - Add 'Lock databases' entry to tray icon menu [[#2896](#2896)] - Add option to minimize window after unlocking [[#3439](#3439)] - Add option to minimize window after opening a URL [[#3302](#3302)] - Request accessibility permissions for Auto-Type on macOS [[#3624](#3624)] - Browser: Add initial support for multiple URLs [[#3558](#3558)] - Browser: Add entry-specific browser integration settings [[#3444](#3444)] - CLI: Add offline HIBP checker (requires a downloaded HIBP dump) [[#2707](#2707)] - CLI: Add 'flatten' option to the 'ls' command [[#3276](#3276)] - CLI: Add password generation options to `Add` and `Edit` commands [[#3275](#3275)] - CLI: Add XML import [[#3572](#3572)] - CLI: Add CSV export to the 'export' command [[#3278](#3278)] - CLI: Add `-y --yubikey` option for YubiKey [[#3416](#3416)] - CLI: Add `--dry-run` option for merging databases [[#3254](#3254)] - CLI: Add group commands (mv, mkdir and rmdir) [[#3313](#3313)]. - CLI: Add interactive shell mode command `open` [[#3224](#3224)] Changed - Redesign database unlock dialog [ [#3287](#3287)] - Rework the entry preview panel [ [#3306](#3306)] - Move notes to General tab on Group Preview Panel [[#3336](#3336)] - Enable entry actions when editing an entry and cleanup entry context menu [[#3641](#3641)] - Improve detection of external database changes [[#2389](#2389)] - Warn if user is trying to use a KDBX file as a key file [[#3625](#3625)] - Add option to disable KeePassHTTP settings migrations prompt [[#3349](#3349), [#3344](#3344)] - Re-enabled Wayland support (no Auto-Type yet) [[#3520](#3520), [#3341](#3341)] - Add icon to 'Toggle Window' action in tray icon menu [[3244](#3244)] - Merge custom data between databases only when necessary [[#3475](#3475)] - Improve various file-handling related issues when picking files using the system's file dialog [[#3473](#3473)] - Add 'New Entry' context menu when no entries are selected [[#3671](#3671)] - Reduce default Argon2 settings from 128 MiB and one thread per CPU core to 64 MiB and two threads to account for lower-spec mobile hardware [ [#3672](#3672)] - Browser: Remove unused 'Remember' checkbox for HTTP Basic Auth [[#3371](#3371)] - Browser: Show database name when pairing with a new browser [[#3638](#3638)] - Browser: Show URL in allow access dialog [[#3639](#3639)] - CLI: The password length option `-l` for the CLI commands `Add` and `Edit` is now `-L` [[#3275](#3275)] - CLI: The `-u` shorthand for the `--upper` password generation option has been renamed to `-U` [[#3275](#3275)] - CLI: Rename command `extract` to `export`. [[#3277](#3277)] Fixed - Improve accessibility for assistive technologies [[#3409](#3409)] - Correctly unlock all databases if `--pw-stdin` is provided [[#2916](#2916)] - Fix password generator issues with special characters [[#3303](#3303)] - Fix KeePassXC interrupting shutdown procedure [[#3666](#3666)] - Fix password visibility toggle button state on unlock dialog [[#3312](#3312)] - Fix potential data loss if database is reloaded while user is editing an entry [[#3656](#3656)] - Fix hard-coded background color in search help popup [[#3001](#3001)] - Fix font choice for password preview [[#3425](#3425)] - Fix handling of read-only files when autosave is enabled [[#3408](#3408)] - Handle symlinks correctly when atomic saves are disabled [[#3463](#3463)] - Enable HighDPI icon scaling on Linux [[#3332](#3332)] - Make Auto-Type on macOS more robust and remove old Carbon API calls [[#3634](#3634), [[#3347](#3347))] - Hide Share tab if KeePassXC is compiled without KeeShare support and other minor KeeShare improvements [[#3654](#3654), [[#3291](#3291), [#3029](#3029), [#3031](#3031), [#3236](#3236)] - Correctly bring window to the front when clicking tray icon on macOS [[#3576](#3576)] - Correct application shortcut created by MSI Installer on Windows [[#3296](#3296)] - Fix crash when removing custom data [[#3508](#3508)] - Fix placeholder resolution in URLs [[#3281](#3281)] - Fix various inconsistencies and platform-dependent compilation bugs [[#3664](#3664), [#3662](#3662), [#3660](#3660), [#3655](#3655), [#3649](#3649), [#3417](#3417), [#3357](#3357), [#3319](#3319), [#3318](#3318), [#3304](#3304)] - Browser: Fix potential leaking of entries through the browser integration API if multiple databases are opened [[#3480](#3480)] - Browser: Fix password entropy calculation [[#3107](#3107)] - Browser: Fix Windows registry settings for portable installation [[#3603](#3603)]
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pass correct entropy amount to keepassxc-browser instead of amount of bits in password/passphrase.
Rename json key from "login" to "entropy" (keeping "login" key as well for backwards compatibility).
Also make some changes to entropy calculation methods:
Type of change
Description and Context
Fix incorrect entropy display in keepassxc-browser
Entropy was being calculated as the number of bits in the password, resulting in a notable overestimation for passwords and a ridiculous overestimation for passphrases. The calculation/estimation is now done with
PassphraseGenerator::getCurrentEntropyandPasswordGenerator::estimateEntropy(password).Rename PassphraseGenerator::calculateEntropy to getCurrentEntropy
calculateEntropy(passphrase)is a misleading, as it actually calculates the entropy a passphrase would have based on the current configuration. If someone were to generate a passphrase, change the configuration, then callcalculateEntropy(passphrase)it would return the amount of entropy a new passphrase would have, rather than the amount of entropy in the passphrase passed to it.Rename PasswordGenerator::calculateEntropy to estimateEntropy
estimateEntropymore accurately describes what the function does.Implement PasswordGenerator::getCurrentEntropy
Implements an accurate entropy calculation based on the current generator configuration, analogous to
PassphraseGenerator::getCurrentEntropy. IfCharFromEveryGroupis set the calculation is based on the inclusion-exclusion principle. I also implemented it so that it would be easy to update the calculation to only require characters from certain groups by adding only those group indices torequiredGroups.Currently unused, but I would be happy to add it to the gui and use it for the entropy amount sent to keepassxc-browser if a consensus is reached regarding #867 and #2061. Personally I would be in favor of having two labels, one for estimation and one for calculation. Upon generating a password both would be updated, but if the user changes the password the calculation label would be hidden. For keepassxc-browser I would prefer it always use the calculation.
This can also be moved to a separate pull request if required.
Screenshots
Incorrect entropy count:
Testing strategy
Manually tested keepassxc gui password generator and keepassxc-browser password generation.
Checklist:
-DWITH_ASAN=ON. [REQUIRED]