Mobile: Android - Bitwarden does not lock after the Vault Timeout duration passes.

[SergeantConfused]

Describe the Bug

The Bitwarden Android client does not lock and require unlocking via master password or Biometrics after the Vault Timeout duration passes. Tested with 1, 5, and 15 minutes.

Steps To Reproduce

1. Open Bitwarden.
2. Go to Settings.
3. Set your Vault Timeout to 1 minute.
4. Wait 2 minutes.
5. Open your Bitwarden application.

Expected Result

To be required to unlock the vault.

Actual Result

Vault is unlocked.

Screenshots or Videos

N/A.

Environment

• Device: Samsung Note 10+.
• Operating system: Android 10.
• Build Version: Bitwarden 2.7.2 (3300).
• Is this a Beta release? N.

Additional Context

N/A.

[steve-gombos]

I also was having this issue.

• Device: OnePlus 7 Pro
• Operating system: Oxygen OS 10.3.7.GM21AA
• Build Version (go to "Settings" → "About" in the app): 2.7.2 (3300)
• Is this a Beta release? N

[cdemi]

Having this issue as well:

• Device: OnePlus 8 Pro
• OS: Oxygen OS OP8Pro_O2_BETA_5
• Build Version: 2.7.2 (3300)
• Not a Beta
• Vault Timeout: 1 Minute
• Vault Action Lock
• Unlock with Biometrics: Enabled
• Unlock with PIN Code: Disabled

I think it has something to do with #1048

[cscharf]

I think it has something to do with #1048

That change was pretty benign and had to do with behavior _after_ the vault was locked... it's more than likely somewhere within https://github.com/bitwarden/mobile/pull/1175. We're looking into this further.

[steve-gombos]

I pulled down the code and have been digging around. I think it is related to the changes from https://github.com/bitwarden/mobile/pull/1175 and specifically with the scenario of closing the application completely then opening it again. If you leave the app running in the background, then come back to it after the timeout, it will lock properly.

[cdemi]

Yes #1175 looks more likely

[tehniemer]

I'm having this issue with a OnePlus 6 on Android 10

[tehniemer]

I pulled down the code and have been digging around. I think it is related to the changes from #1175 and specifically with the scenario of closing the application completely then opening it again. If you leave the app running in the background, then come back to it after the timeout, it will lock properly.

This comment got me thinking, I excluded the app from all battery optimization and it's back to locking as expected again.

[jlzizmor]

i'm having the same issue on a Samsung Galaxy S9 on Android 10.

@tehniemer , have you seen any negative effects of excluding the app from battery optimization?

[tehniemer]

@jlzizmor I just excluded this morning so I don't have any long term data.

[steffenw94]

I have same issue on Google Pixel 3a.
Sometimes the vault is locking, sometimes not.
For me i wait for fix to use this app again because i think this is high security lack

[mportune-bw]

@steffenw94 is your Pixel 3a fully updated with the latest Android build & security updates? Also are you running with any particular power management functions enabled, like battery saver, or the new extreme battery saver, or some 3rd party tool?

To everyone else: I'm not ignoring you, just trying to reproduce this and I have access to the 3a (plus a 4a and a Galaxy S10 if anybody can reproduce this with those)

[matthewarmand]

@mportune-bw I also have a Pixel 3a and am experiencing this if you need some extra reproduction/testing at some stage. I keep the device and security patches as up to date as I can, here's where mine is at currently:

Build number: RQ1A.201205.003
Android version: 11
Security update: 5 December 2020

Adaptive Battery and Battery Optimization are enabled, Battery Saver turns on at 10% but typically isn't on, and I am not currently using the new Extreme Battery Saver under any case.

[jimmyj352]

I started having the same issue on my Samsung Galaxy S8 as does my wife on her Moto G8 Power. Both phones are up-to-date with the latest builds and security updates. No special power management or battery saver tools are running on either phone. I tested excluding the Bitwarden app from Samsung's battery optimization but that didn't fix the issue.

Galaxy S8 Unlocked:
Model number: SM-G950U1
Android 9
Build number: PPR1.180610.011.G950U1UES8DTJ1
Android security patch level: October 1, 2020

Moto G8 Power Unlocked
Model number: XT2041-4
Android 10
Build number: QPMS30.80-63-6-8-3
Android security patch level: November 1, 2020

[tehniemer]

To follow up, excluding from battery optimization was only a temporary fix for me, it's reverted to the behavior in this issue.

[mportune-bw]

Thanks everyone for the info. @matthewarmand What is your vault timeout and timeout action set to? Are you using bio and/or PIN to unlock?

[matthewarmand]

Thanks everyone for the info. @matthewarmand What is your vault timeout and timeout action set to? Are you using bio and/or PIN to unlock?

Vault timeout is set to 15 minutes, action is set to Lock. I'm using neither bio nor pin, just master password to unlock.

[mportune-bw]

Can everyone here try clearing app data (or uninstall/reinstall) and see if that changes anything? (I'm curious about the behavior of a particular stored pref)

[jimmyj352]

I just tested...

1. Cleared app data for Bitwarden
2. Launched app and logged back in
3. Adjusted settings to be lock after 1 minute
4. Went to a different app in the foreground
5. Set a timer for just over a minute
6. Turned phone screen back on and opened Bitwarden
7. No prompt for security - still wide open

UPDATE: I was doing some other stuff and then just went back over to my phone. I unlocked my phone and forgot I still had Bitwarden open... it was prompting for me to login. So maybe it didn't lock right after the 1 minute mark, but it did lock.

[matthewarmand]

@mportune-bw I uninstalled and reinstalled, unlocked, waiting 16 minutes, and the vault did auto-lock. It's been an hour or so, so I'm going to keep trying over the next several hours and if I notice it failing to lock again I'll let you know, but for the moment a full reinstall seems to have done the trick on my device.

[mportune-bw]

Thank you both, this is very helpful. @jimmyj352 How long (approximately) after the 1 minute mark did you attempt to unlock on your initial test?

[jimmyj352]

@mportune-bw I just checked again and it still hasn't locked after probably 2-3 minutes of inactivity. I'm going to clear the app data on my wife's phone and see how it goes there. I'll let you know shortly.

[jlzizmor]

@mportune-bw I tried uninstalling and re-installing. I changed the timeout to 5 minutes (how I usually keep it) from the default of 15 minutes, waited 5 minutes, and it was still locked. I'm now waiting another 15 minutes to see if the change to a 5-minute timeout wasn't processed.

[jimmyj352]

@mportune-bw Just completed the same test on my wife's Moto G8 with clearing the app data. Logged back in, set the auto-lock to 1 minute, and then backed out of the app. I set a timer for 1 minute and went back to Bitwarden and it was locked so that's a good thing.

[mportune-bw]

Quick sanity check to make sure everyone is running 2.7.2 for this experiment (we halted the rollout so not everyone may have it yet - you can sign up for the beta in the Play Store if you don't)

[matthewarmand]

2.7.2 confirmed here. Should have checked that before the re-install, but if 2.7.2 came out anymore before the last day or two I was probably updated to it

[jlzizmor]

I tried uninstalling and re-installing. I changed the timeout to 5 minutes (how I usually keep it) from the default of 15 minutes, waited 5 minutes, and it was still locked. I'm now waiting another 15 minutes to see if the change to a 5-minute timeout wasn't processed.

@mportune-bw after 15 minutes going back into the app it was still unlocked. On the off chance that there's a difference, I'll try clearing the app data and run the same test.

Quick sanity check to make sure everyone is running 2.7.2 for this experiment (we halted the rollout so not everyone may have it yet - you can sign up for the beta in the Play Store if you don't)

The "About" popup says that I'm running "2.7.2 (3300)"

[jimmyj352]

@mportune-bw Good call on the version check.

My wife is still running 2.6.1 on the Moto G8 Power that is working fine with the auto-lock now.

My Samsung Galaxy S8 is running 2.7.2 and is still having the issue. I have the auto-lock set for 1 minute and then keep setting a timer. I checked after 1 minute... still unlocked. Set a timer for 2 minutes and then checked... still unlocked. I'm up to a 5-minute timer and it's still not locking.

[jimmyj352]

So, I just noticed something that seems to line up with what happened earlier during my first test. I just went to my phone (it's only been a couple of minutes) and hadn't backed out of the app so Bitwarden was front and center. It prompted me to login. That was the same thing that happened with my first test when it seemed like the auto-lock was working. In other words, it's looking like if Bitwarden is active, it can process the auto-locking but if it's in the background it can't. I'm guessing you already know this, but thought I'd share regardless.

Let me know if you want me to test anything further.

[mportune-bw]

@jimmyj352 Just to confirm - Bitwarden was the foreground app but the screen was off (device sleep) while waiting, correct?

[jlzizmor]

after 15 minutes going back into the app it was still unlocked. On the off chance that there's a difference, I'll try clearing the app data and run the same test.

i cleared the app data, signed back in, changed the timeout to 5 minutes. then i got distracted and didn't set my timer right away so i was away from the app for well more than 5 minutes, but when i returned it did prompt me for my code

[jimmyj352]

@jimmyj352 Just to confirm - Bitwarden was the foreground app but the screen was off (device sleep) while waiting, correct?

That is correct - both times that the auto-lock worked successfully.

[rsngfrce]

@steffenw94 is your Pixel 3a fully updated with the latest Android build & security updates? Also are you running with any particular power management functions enabled, like battery saver, or the new extreme battery saver, or some 3rd party tool?

To everyone else: I'm not ignoring you, just trying to reproduce this and I have access to the 3a (plus a 4a and a Galaxy S10 if anybody can reproduce this with those)

If it matters, I believe I am the one who originally reported this issue on my Galaxy S10e. I reverted to 2.7.0 from 2.7.2 and have not had the issue since. Another user confirmed this issue to me, but reported that the vault WOULD lock if set to immediate (as opposed to a to time length).

[rfoliva]

I can confirm setting lock to immediately as a workaround for me as well.

On Sat., Jan. 9, 2021, 11:08 a.m. rsngfrce, [e-mail]
wrote:

@steffenw94 https://github.com/steffenw94 is your Pixel 3a fully
updated with the latest Android build & security updates? Also are you
running with any particular power management functions enabled, like
battery saver, or the new extreme battery saver, or some 3rd party tool?

To everyone else: I'm not ignoring you, just trying to reproduce this and
I have access to the 3a (plus a 4a and a Galaxy S10 if anybody can
reproduce this with those)

If it matters, I believe I am the one who originally reported this issue
on my Galaxy S10e. I reverted to 2.7.0 from 2.7.2 and have not had the
issue since. Another user confirmed this issue to me, but reported that the
vault WOULD lock if set to immediate (as opposed to a to time length).

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/bitwarden/mobile/issues/1196#issuecomment-757328064,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ACPZRO4C5EFPGXLB7Y2O6KDSZB5O7ANCNFSM4VL3SQBQ
.

[jerheij]

I have start noticing this issue happening to my Bitwarden Android app as well.

Samsung Galaxy S10+ (locked/unrooted)
Model number: SM-G975F
Android: 10
Security patch: 1-12-2020
Bitwarden app: 2.7.2(3300)

Samsung Tab s5e
Android: 10
Bitwarden app: 2.7.2(3300)

[matthewarmand]

As an update btw, the reinstall was a temporary fix and my Pixel 3a has started "not locking" again :cry:

[rfoliva]

@jerheij and @matthewarmand - setting Timeout Action to Immediately should work for now. At least, it does for me on Android.

Otherwise, we need to wait for new release.

[markangus2b]

Same issue on the Pixel 2XL.

[mportune-bw]

Everyone, version 2.7.3 has just been pushed to the beta channel on the Play Store (it usually takes Google a few hours to approve it). You can also grab the build directly from here if you don't want to wait (scroll down to Artifacts). If you could give this a whirl over the weekend and report back I'd appreciate it.

[jimmyj352]

@mportune-bw Downloaded the beta (2.7.3) from your Github link, installed, and verified the version number. I set the timeout for a minute, hit the home button, and tested after a minute - it was locked as it should be. Changed the timeout to 15 minutes and did the same... success. From what I'm seeing, it looks like the problem has been fixed - thank you!

[matthewarmand]

@mportune-bw I signed up for the beta and got the new version that way, have tested a couple times and everything seems smooth so far. I'll keep an eye on it over the weekend and let you know if I notice anything off

[cdemi]

I have downloaded the beta from the Play Store and can also confirm that the fix is working so far!

[rsngfrce]

Samsung Galaxy S10e, Android 10

I was unable to update from 2.7.0, which I had reverted to from APKMIRROR, either from here or by signing up for the beta on the Play Store because I got the message, "Security policy prevents updating this application." This is a personal phone and I have never seen that message before.

I had to uninstall Bitwarden and then I was able to install the beta from the Play Store, which has been working fine so far.

[mportune-bw]

Thanks everyone for the feedback, glad to hear it's working.

@rsngfrce I'm not sure what would cause that unless Google Play refuses to update an APK installation with an AAB (bundle) installation, or maybe the APK from APKMIRROR was the F-Droid version which is signed with a different release key to prevent accidental overwrites by the Play Store.

[tehniemer]

Play store beta seems to fix the issue for me, it's been 12+ hours.

[jerheij]

I have start noticing this issue happening to my Bitwarden Android app as well.

Samsung Galaxy S10+ (locked/unrooted)
Model number: SM-G975F
Android: 10
Security patch: 1-12-2020
Bitwarden app: 2.7.2(3300)

Samsung Tab s5e
Android: 10
Bitwarden app: 2.7.2(3300)

I installed the beta on both the devices, set it to one minute lock and both seemed to work as intented.

[simonai1254]

I could reproduce this issue as well on the following device (already reported via mail):

Samsung Galaxy Note 8 (not rooted)
Android 9
Security Patch: 2020-10-01
Bitwarden App: 2.7.2(3300)
Bitwarden Timeout: 15 minutes
Biometric Login: Enabled
Power Saving: No special power saving restrictions enabled, using system default settings.

I openend Bitwarden, copied a password and used it elsewhere and continued using the phone. After 30 minutes (Bitwarden in Background and/or phone screen turned off) when trying to access another password I could retrieve it without being prompted to authenticate.
Now after joining the Beta the update to 2.7.3 (3335) and changing the Lockout Time to 1 Minute the app seems to behave correctly. Now I've switched it back to 15 minutes and will continue to monitor the behavior.

Regards

[mportune-bw]

Thanks again everyone, closing this issue now. We're planning to push releases this week and this will be included.