option to only keep pass phrase in memory

[tomholub]

part of #1298

[tomholub]

part of #714

[DenBond7]

@tomholub Could you share more details? I mean how do you see that. Because due to the difficult lifecycle of the Android app we can have different thoughts about this issue. I need a little more info.

[bilalashraf123]

When generate key pair in Android, there is an option to associate an authentication mecahism with it. The authentication mechanism could be device fingerprint. For this, fingerprint needs to be registered.

If authentication mechanism is bound to the key, one cannot access the key without providing the fingerprint. If user deletes the fingerprint on Android device, then that particular key cannot be accessed anymore.

When use Android key store provider, the key pair is generated and stored in TEE (Trusted execution environment)/StrongBox and cannot be exported. TEE is available I believe after Andoid 6.

[tomholub]

Sorry Bilal - this issue is not about user's fingerprint or TEE or pins or other similar mechanisms. While this is a related concern (how to ensure that user has acceptable UX on a phone, instead of having to always input long pass phrases), this particular issue is purely about not storing pass phrases in long-term storage. Above, Den is asking about how exactly to achieve that, which may involve some of what you mentioned, but that's not the core of the issue.

For this particular issue, I'd like to see something like this:

---

(consumers) During setup (of new OpenPGP key, or when importing key or when loading from backup - whenever I'm creating or entering pass phrase), the user should see two radio buttons:

o store pass phrase locally
o keep pass phrase in memory

Default is to store, just like now.

If the user switches it to memory-only, then we do not store pass phrase with the key (or at all). We only keep the pass phrase in memory for up to 4 hours from the moment it was stored - then it needs to be forgotten. During those 4 hours, the key will be used for actions (eg decrypt messages). After those 4 hours, the user will be prompted for a pass phrase with a modal / alert to re-enter it, at which point it will be again remembered for 4 hours.

If app gets killed, pass phrase gets forgotten.

For now, there will be no way for user to switch this anywhere in settings. They would have to log out and re-setup.

---

(enterprise users with appropriate OrgRule as described in #1168 - don't ask user, automatically only store in memory)

---

@DenBond7 with this in mind - is this achievable purely using standard Java code? Just keep some information in background process in memory for up to 4 hours, then wipe it?

[DenBond7]

@tomholub Thanks! That's what I meant.

with this in mind - is this achievable purely using standard Java code?

It's ok in the Java world. But... It can be a little difficult on Android. Let me explain. We can have any data in the RAM while the app process is alive. But you can easy reproduce a situation that kills our process due to memory optimization. And it will a regular Android system behavior. For example, please run FlowCrypt then move it to the background. After that try to open 10-20 different apps. After that try to open FlowCrypt and you will that the app starts from the fresh state. It depends on different things: manufacturer, RAM and etc. I can't control that.

So only the following can be true:

1. Keep passphrase up to 4 hours in the RAM
2. While 1 is true keep passphrase in the RAM if the app process is alive.(it can be from 0 up to 4 hours as I described in 1.)

[bilalashraf123]

Can we do something like this?

• store pass phrase locally
• keep pass phrase temprarily - In this case, store passphrase for 4 hours in local storage securely

When keep pass phrase temprarily, we can apply same security mesaures as we are are for option store pass phrase locally, only difference is the prompt of passphrase after 4 hours or not.

After 4 hours, clear the passpharse and store again securely after taking input from the user.

[DenBond7]

@bilalashraf123 of course we can do that. We can have a task for Work manager that will check and clear temporary passphrases.

@tomholub
I'm thinking about one more way. We can use for example https://developer.android.com/guide/components/foreground-services. In that case we can have our passphrases in RAM. But we will have to show a notification in the status bar always.

[DenBond7]

For example like Mi Fit, Google Translate

[bilalashraf123]

please correct me If I am wrong. The actual requirement could be not to ask for passphrase for 4 hours. It does not matter where to store the password temporarily.

[tomholub]

please correct me If I am wrong. The actual requirement could be not to ask for passphrase for 4 hours. It does not matter where to store the password temporarily.

We didn't discuss this in detail on mobile apps, just a note that "eventually would be good to use fingerprint or pin to protect the pass phrase".

We did discuss it on the browser extension, where we could use session storage (that browser may store to file system) that we manually empty after 4 hours, and this was rejected - saving it locally is a hazard that the customer does not want.

On Android the situation is a bit different due to the abundance of options to address this further (pin/fingerprint/secure keychain and so on) but I don't want to get into it yet, because it's an implementation and design rabbit hole (plus so many types of devices, etc).