Replace a QVector for the wordlist with a QSet. This removes all duplicate entries in a given wordlist.
Thus, it hinders a malicious wordlist that has the proper length (>4000 entries) but with repetitions (effectively << 4000 entries) to be used and potentially create weaker passphrases than estimated.
Example:
List with 4000 items but only 64 unique words would lead to only 48 bit of Entropy instead of ~95 bit!
Includes following changes:
* Encryption Settings now has a similar key with the new database wizard for switching between Advanced and Simple Settings
* The extra UI layer DatabaseSettingsDialog.ui has been removed. DatabaseSettingsDialog class now inherits EditWidget instead of DialogyWidget (just like Application Settings).
* Extra classes for separate page settings (DatabaseSettingsPageFdoSecrets, DatabaseSettingsPageKeeShare) have been removed. Instead the widgets are used directly in DatabaseSettingsDialog. Same could be done later to Application
---------
Co-authored-by: Jonathan White <support@dmapps.us>
Bump the minimum required Qt version up to 5.12, as per
https://github.com/keepassxreboot/keepassxc/issues/10859#issuecomment-2148477826.
Previously, the minimum version was 5.2.0 based on the CMakeLists.txt
check, though it's unclear if such old versions would actually work.
With this, we are able to remove a whole bunch of #ifdef'd code.
* Snap: Improve Web-browser Native Messaging host functionality
This commit allows for the snap distribution of KeepassXC to self-manage native messaging manifests
This is done by making the binary aware of the snapd environment changes that currently prevent this.
Furthermore, the snap sandbox is expanded to the bare minimum needed to access these privileged files.
Please note if running a self-compiled / untrusted KeepassXC snap build (I.E, installed with --dangerous)
that you must manually run `sudo snap connect keepassxc:browser-native-messaging` to grant permissions.
This will work on all distributions that expose `/snap/bin/` - such as Ubuntu, Debian, etc.
For systems which don't provide `/snap/`, such as Fedora, follow instructions for enabling "Classic" snaps.
e.g., `sudo ln -s /var/lib/snapd/snap /snap`
---------
Co-authored-by: Jonathan White <support@dmapps.us>
* Fixes#10723 - only display password strength warning when actively editing the password
* Also improve behavior of minimum quality warning
* Improve behavior and handling of password changes with the database settings dialog
* Prevents loss of newly entered password when toggling between elements in the settings page
* On error, switch to tab that prevents saving database settings for easier correction
* Provide remote database sync capability
Allow arbitrary commands to be defined and executed for syncing databases with remote services. This includes sftp, scp, rsync, etc.
Remote commands are stored per-database and sync operations are manually triggered by the user from the Database -> Remote Sync menu.
---------
Co-authored-by: Stefan Forstenlechner <t-h-e@users.noreply.github.com>
Co-authored-by: Jonathan White <support@dmapps.us>
* Fixes#10400
- Support TOTP entries with bare secrets instead of otpauth urls for Bitwarden. Vice-versa for 1PUX.
- Support Bitwarden Argon2id encryption scheme
* Fixes#10380 - Support Bitwarden organization collections
* This removes the application setting to require typing the password in again even though it is visible.
* Removed automatic password repeat when the password is made visible on changing.
* Closes#7545 - Support 1Password 1PUX import format based on https://support.1password.com/1pux-format/
* Closes#8367 - Support Bitwarden JSON import format (both unencrypted and encrypted) based on https://bitwarden.com/help/encrypted-export/
* Fixes#9577 - OPVault import when fields have the same name or type
* Introduce the import wizard to handle all import tasks (CSV, KDBX1, OPVault, 1PUX, JSON)
* Clean up CSV parser code to make it much more efficient and easier to read
* Combine all importer tests (except CSV) into one test file
Refactors the Passkey implementation to include more checks and a structure that is more aligned with the official specification.
Notable changes:
- _BrowserService_ no longer does the checks by itself. A new class _BrowserPasskeysClient_ constructs the relevant objects, acting as a client. _BrowserService_ only acts as a bridge between the client and _BrowserPasskeys_ (authenticator) and calls the relevant popups for user interaction.
- A new helper class _PasskeyUtils_ includes the actual checks and parses the objects.
- _BrowserPasskeys_ is pretty much intact, but some functions have been moved to PasskeyUtils.
- Fixes Ed25519 encoding in _BrowserCBOR_.
- Adds new error messages.
- User confirmation for Passkey retrieval is also asked even if `discouraged` is used. This goes against the specification, but currently there's no other way to verify the user.
- `cross-platform` is also accepted for compatibility. This could be removed if there's a potential issue with it.
- Extension data is now handled correctly during Authentication.
- Allowed and excluded credentials are now handled correctly.
- `KPEX_PASSKEY_GENERATED_USER_ID` is renamed to `KPEX_PASSKEY_CREDENTIAL_ID`
- Adds a new option "Allow localhost with Passkeys" to Browser Integration -> Advanced tab. By default it's not allowed to access HTTP sites, but `http://localhost` can be allowed for debugging and testing purposes for local servers.
- Add tag `Passkey` to a Passkey entry, or an entry with an imported Passkey.
Fixes#10287.
Closes#2689
The design of the respective code is loosely based on KDE's KActionCollection. The ActionCollection manages all actions that can be shortcut configured. These actions are then exposed in the config and a user can assign a different shortcut.
Actions inside the MainWindow have been added to the ActionCollection.
---------
Co-authored-by: Jonathan White <support@dmapps.us>
* Set default value of DatabasePasswordMinimumQuality to 3 (do not accept a master password that is less than Good)
* Add custom message box button "Continue with weak password"
Closes#5991Closes#3337 - Support fingerprint readers on Linux
Polkit allows for authentication of many means, including fingerprint scanning. Furthermore, a common interface for Quick Unlocking has been implemented, and has been replaced throughout to make implementing other quick unlock strategies easier.
Refactor QuickUnlock to use UUID stored in headers. This is a new feature using the KDBX 4 standard to store a randomly generated UUID in the public headers of the database. This enables identification of KDBX file without relying on path or filename and will eventually support persistent Quick Unlock.
* Fix#7892 - Pressing escape when the quick unlock prompt is shown will now go back to the main unlock dialog view.
* Fix#9030 - Quick unlock will be automatically invoked in the unlock dialog upon being shown.
* Fix#9554 - Quick unlock application setting will be updated every time the settings widget is shown instead of just on first launch.
* Show warning that quick unlock is not enabled if user cancels Windows Hello prompt. This should limit people thinking there is a security issue. Also improve documentation describing this behavior.
* Disable quick unlock in gui tests
