Mobile: Android Accessibility Service

[kspearrin]

Create accessibility service to detect login fields and auto-fill username/passwords.

[callaars]

Can we have this optional please, I personally don't like it auto-auto-filled.

[kspearrin]

@bcallaars It would be optional since you have to manually enable the accessibility service in settings.

[grubernaut]

This would be amazingly helpful if it didn't require a secondary keyboard to switch to, like 1Password requires.

[kspearrin]

I am doing some research on this issue and am looking at the Keepass2Android implementation. I see that it uses system notifications to give me the ability to copy the username/password to clipboard whenever it detects a password field on screen, but I do not see where it pops up an overlay that lists my logins to pick from and actually autofill. Am I missing something? Anyone familiar with the Keepass2Android app?

[mrchecky]

Any updates on time frame for this feature? Deal breaker for me until it's implemented. Hope to see it soon. Thanks

[kspearrin]

See my last comment. I am still looking for examples of a good implementation (other than LastPass). Some of the work has already been started.

[CGrandez]

Try the (sticky password) application. It has a floating option that allows you to choose between your accounts.

[CGrandez]

Another good application is (Dashlane Password Manager)

[kspearrin]

I have autofill working well in the following browsers:

• Chrome
• Android
• Brave
• Opera

If anyone is interested in helping beta testing the next release of the mobile app with the autofill service, let me know. You can email me on the website using the contact form or join our gitter chatroom here: https://gitter.im/bitwarden/Lobby

[kspearrin]

For those who wish to beta test autofill, attached is a beta build APK you can download and install. Please uninstall existing versions of bitwarden before installing this one. Also note that you shouldn't continue to use this version and should uninstall it and re-download from the play store once done testing.

Download here: [REMOVED - See google play link below for testing now]

[kspearrin]

I've set up alpha testing on the Google play store now for this. You can get the nightly build for this here: https://play.google.com/apps/testing/com.x8bit.bitwarden

The plan is to have autofill released at some point next week.

[lucacome]

Can't seem to login with the alpha...

[kspearrin]

@lucacome The alpha is still in being developed with some changes to the authentication process, so if you have 2FA turned on, you wont be able to log in currently. If you want to test you'll need to disable 2FA for now. Do you have 2FA turned on for your account?

[kspearrin]

@lucacome 2FA is now available again with the latest alpha build.

[kspearrin]

Also, those who may want to test this outside of the play store, you can always download the latest APK attached to our CI builds here: https://ci.appveyor.com/project/bitwarden/mobile/build/artifacts

[Primokorn]

Video of Bitwarden 1.2.1
As you can see, the notification is automatically removed as soon as I open the notification panel or I open the keyboard.
Android 7.1.1 - OnePlus 3T

[kspearrin]

Another user reported the same thing when he had the lastpass auto fill service turned on still. When he turned off lastpass it started working correctly. I wasn't able to reproduce it though. Do you happen to have that on? Investigating....

[kwiky]

I have the same issue. I turned off lastpass service and turned on bitwarden service in accessibility settings, but i have never seen the bitwarden auto-fill notification.
Bitwarden 1.2.1 (436)
Samsung Galaxy S7 Edge

[kspearrin]

@kwiky what android version?

[kwiky]

@kspearrin 6.0.1

[kwiky]

@kspearrin sorry, it works on android apps and chrome, but not with firefox.
Sorry because lastpass always display his notification, and bitwarden notification is only displayed when login fields is detected. This is why i thought it doesn't works

[kwiky]

This is maybe why lastpass always display this notification, because of apps like firefox ?

[kspearrin]

Firefox browser is not supported at this time.

[sreich]

LastPass always displaying the notification is a feature. It's an option in its settings and it proves most useful because the auto detection is definitely not foolproof, even for LastPass.

Disabling LastPass service seemed to have worked around bitwarden hiding it's notification before you can hit it, but obviously isn't a fix.

[Primokorn]

@kspearrin no changes after switching off Lastpass accessibility service.

[kspearrin]

@Primokorn

The way the accessibility service works is that it receives events every time something changes on your screen. That can be opening a new screen, focusing a textbox, opening the notification center, scrolling a web page, etc. When these events occur I get certain information such as which app is causing the event to occur, what text fields are on the screen, etc.

The logic every time these events are received is:

1. Is this a com.android.systemui event?
   
   
   
   • Yes? Return immediately. Nothing to do.
   
   
   • No? Continue to step 2.
   
   
2. Does the event's window "context" have any password fields on it?
   
   
   
   • Yes? Show a notification.
   
   
   • No? Dismiss any previous notifications.
   
   

Opening the notification center and keyboard are suppose to be com.android.systemui events, so they should be stopped (returned) from dismissing the notification. Obviously that doesn't seem to be happening with your device. Therefore it is going to step 2 in which it doesn't find any password field on the event's "context". In this case the context is likely your keyboard or notification center, not the information on the screen "behind" it.

Any idea why those wouldn't be classified as com.android.systemui events? Are you using some custom keyboard or something that might be classified differently?

Are you available at some time to help me debug the issue in live chat or anything? It's very difficult to try to resolve issues like this that I can't reproduce but are obviously affecting people. All reports I have heard about this so far have been on Android 7.1 which may also be a common denominator. Do you have any other devices you could test it out on to see if the issue persists?

[sreich]

On my lunch break, but I'm using GBoard (Google keyboard). I won't be able to help for a while so perhaps someone else can sooner.

[kspearrin]

@sreich @Primokorn I just pushed build 437 to the beta slot. Please give that a try for a possible fix.

[Primokorn]

@kspearrin this new update fixes the notification issue. Thanks. I'm on 445, though.

I tested with the mobile app of my mobile carrier (Bouygues Telecom).
In my vault my logins are stored this way:

Name: Bouygues My Account
Website: bouyguestelecom.fr
Username: my phone number
Password: ••••••••••••••••••••

While opening the app (package name: fr.bouyguestelecom.ecm.android) bitwarden is looking for ecm.android.
The screen '_logins for ecm.android_' is loading again and again and bitwarden doesn't find anything.

[kspearrin]

Awesome. Thanks to @sreich I was able to somewhat reproduce the issue using gboard.

This is because apps are searched for differently that websites.

It's looking for a login with the explicit uri "androidapp://packagename" which is different than the web address.

I could start searching it for the reverse domain, but that could potentially be exploited since a person can give their app whatever reverse domain package name that they want. For example, I can call my package "com.google.bitwarden" and get it to list your google logins for you to auto fill into my app. Not really sure the best way to handle that.

[kspearrin]

There is a new feature in the web vault that lets you configure equivalent domains. So you could also associate androidapp://packagename with a Website domain and it will then suggest it to you when searching.

[kspearrin]

I'm pretty happy with the latest build. Unless anyone has any objections, I'll plan on pushing to production tomorrow some time.

[kspearrin]

Anyone have an Android 5.x device? I haven't been able to test that version and I am curious if the populating of text fields during the autofill process works or not. It doesn't on 4.4 so I show an alternate flow that offers copy/paste instead. Wondering if I need to do that for 5.x as well or not. 6.x and 7.x are tested and good to go.

[kspearrin]

This has now been completed and available on the play store. See blog post for full details: https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill-a0b582ada0e9#.gv2t8a8dt

[cwmke]

I am doing some research on this issue and am looking at the Keepass2Android implementation. I see that it uses system notifications to give me the ability to copy the username/password to clipboard whenever it detects a password field on screen, but I do not see where it pops up an overlay that lists my logins to pick from and actually autofill. Am I missing something? Anyone familiar with the Keepass2Android app?

I've been using Keepass2Android for awhile and in order to search for sites, you switch to their keyboard and then click the little button with an android picture on it which brings up a menu asking to either select an entry or use the option presented.

Personally I greatly prefer the keyboard over the accessibility option due to accessibility triggering,

your device won't use your screen lock to enhance data encryption.

[sreich]

That's Android being misleading, see here:

https://lastpass.com/support.php?cmd=showfaq&id=8936

Just enable it then set (even if it was set before) your passphrase. It will warn you that accessibility services won't be able to startup.

I don't think this happens at all in Android 7 because it uses per file encryption and apps that want to can be activated pre boot in a separate storage area. Like an alarm clock (so it can wake you up even before you put in your password, for instance.

But anyway the idea was that eg blind users would want accessibility services to be available at startup.

So yeah, it's perfectly fine and secure to use that assuming you do that extra step, as far as I know.