Mobile: Auto-fill immediately when Unlock with PIN enabled and app already unlocked

Feature Requests Password Manager
1

Target: mobile apps.

Precondition: Unlock with PIN is enabled. My BW app/vault is unlocked

Current behavior: I invoke Bitwarden’s Auto-fill to fill credentials in some app. BW prompts me to enter my master password, even though the app is already unlocked.

Proposed behavior: I invoke Bitwarden’s Auto-fill to fill credentials in some app. BW auto-fills the credentials without any further authentication.

Rationale:

  • Convenience: I’ve already unlocked the app, why should I need to log in again for an Auto-fill?.
  • Security 1: I want Auto-fill using PIN instead of using biometrics because my phone unlocks with biometrics. Given that my phone unlock with biometrics, I don’t want a critical app – Bitwarden – to unlock in the same way. This is defense in depth.
  • Security 2: If the app I’m trying to Auto-fill into is malicious, it could (I assume) bring up a fake Bitwarden master password prompt dialog to capture my master password. Capturing my master password is very bad, and I will never enter my master password into a dialog that might be controlled by another app. So currently I can’t use the Auto-fill feature, and I instead need to go to the Bitwarden app to copy the credential’s password whenever I would otherwise use Auto-fill.
  • Security 3: There are some apps whose creators have blocked pasting into the password field. For those apps, using Bitwarden’s Auto-Fill – which seems to bypass the block – is the only reasonable way to get my complex password into the password field. But see the previous bullet: I’m not willing to enter my master password while another app is active.
  • Security 4: Manually pasting credentials into any app is dangerous because it bypasses the domain/host check that BW does before it Auto-fills. BW is currently making me manually paste, which is very bad.
2

Hi @Joe4! Does this happen for you on IOS or Android?

I tested your scenario on my Android Pixel 5a and it already works the way you want it to work. Here is what I did:

  1. I disabled biomerics and enabled PIN.
  2. I locked the Bitwarden App and closed it.
  3. I opened the Bitwarden App and logged in with the PIN.
  4. I opened one of my Android apps (Mint Mobile) and it displayed the login screen and Bitwarden popup for logging in.
  5. I picked the Bitwarden popup to login and the credentials immediately filled into the App. It did not ask me for a PIN or Master Password.

Isn’t this what you wanted to happen? What am I missing?

3

Thanks for the Android testing, @RogerDodger! The repro you described matches my feature request. I’m glad it works properly on Android.

It’s on my iPhone and iPad that the problem I described occurs. And the problem occurs for both browser-based login forms and app login screens.

Given that it works on Android:

  • maybe this should be a bug report and not a feature request
  • or maybe it can’t be done on iOS/iPadOS – but LastPass (RIP!) does support it
  • or maybe it was too much work to implement on iOS/iPadOS.

Not sure.

4

My Vault Timeout in the Bitwarden App is set to 5 minutes and my Vault Timeout Action is set to Lock.

What are your settings?

5

On iOS it will ask for the PIN when using autofill if you choose to select the option that allows the PIN to unlock Bitwarden after it has been closed (that is, swiping up on Bitwarden from the App Switcher or shutting down your phone). However, if you opt to use the master password to unlock Bitwarden when closing it and not the PIN, it will always require the master password when autofilling. That includes after you have already unlocked the Bitwarden app with the master password and can now unlock Bitwarden by using the PIN.

If you do require the master password when unlocking Bitwarden after you have quit it, that might be the cause. Is that the intended behaviour? I wouldn’t think so because it doesn’t make using autofill easy when it always requires the master password when the application doesn’t.

6

@Joe4 I just noticed - is this a duplicate Feature Request to the one you made 9 days ago?

If so, then these duplicate Feature Requests should be merged into one.

Edit: I see they are slightly different, but related.

7

@RogerDodger: I have:

  • vault timeout: 5 mins
  • vault action timeout: lock
  • unlock with face id: off
  • unlock with PIN code: on

–

@Doge7734: Thanks, very interesting! When setting up Unlock with PIN, I did indeed configure to require the MP after the app is force-quit – for the sake of increased security.

I just replicated your statement: if I configure to not require the MP after the app is force-quit, when I try to Auto-Fill I am indeed prompted for the PIN.

That’s great input if someone tries to fix this. I’m guessing it’s not the intended behavior for the reason you stated and because Android behaves differently.

–

@RogerDodger: Good question. They are different issues but they are definitely very related and possibly have the same root cause. The first one I posted was for the app logged in but locked, and the second one (this one) is for the app unlocked. In the first one I expected a PIN prompt, and in the second one (this one) I expect no prompt.

I probably should have created one request covering both changes.