Pass phrase strength should be properly checked before encrypting

[tomholub]

[STACK_TRACE]
com.flowcrypt.email.util.exception.ManualHandledException: Handled manually:
        at com.flowcrypt.email.util.exception.ExceptionUtil$Companion.handleError(ExceptionUtil.kt:30)
        at com.flowcrypt.email.service.actionqueue.ActionQueueIntentService.onHandleWork(ActionQueueIntentService.kt:59)
        at androidx.core.app.JobIntentService$CommandProcessor.doInBackground(JobIntentService.java:392)
        at androidx.core.app.JobIntentService$CommandProcessor.doInBackground(JobIntentService.java:383)
        at android.os.AsyncTask$2.call(AsyncTask.java:333)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at java.lang.Thread.run(Thread.java:764)
Caused by: com.flowcrypt.email.util.exception.NodeException: Error :Error: Pass phrase length seems way too low! Pass phrase strength should be properly checked before encrypting a key.
Stack :Error: Pass phrase length seems way too low! Pass phrase strength should be properly checked before encrypting a key.
    at Endpoints.encryptKey ([eval]:71873:15)
    at process._tickCallback (internal/process/next_tick.js:68:7)
Type :null
        at com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor$Companion.checkResult(NodeCallsExecutor.kt:189)
        at com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor$Companion.encryptKey(NodeCallsExecutor.kt:134)
        at com.flowcrypt.email.service.actionqueue.actions.EncryptPrivateKeysIfNeededAction.run(EncryptPrivateKeysIfNeededAction.kt:73)
        at com.flowcrypt.email.service.actionqueue.ActionQueueIntentService.onHandleWork(ActionQueueIntentService.kt:53)
        ... 7 more
com.flowcrypt.email.util.exception.NodeException: Error :Error: Pass phrase length seems way too low! Pass phrase strength should be properly checked before encrypting a key.
Stack :Error: Pass phrase length seems way too low! Pass phrase strength should be properly checked before encrypting a key.
    at Endpoints.encryptKey ([eval]:71873:15)
    at process._tickCallback (internal/process/next_tick.js:68:7)
Type :null
        at com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor$Companion.checkResult(NodeCallsExecutor.kt:189)
        at com.flowcrypt.email.api.retrofit.node.NodeCallsExecutor$Companion.encryptKey(NodeCallsExecutor.kt:134)
        at com.flowcrypt.email.service.actionqueue.actions.EncryptPrivateKeysIfNeededAction.run(EncryptPrivateKeysIfNeededAction.kt:73)
        at com.flowcrypt.email.service.actionqueue.ActionQueueIntentService.onHandleWork(ActionQueueIntentService.kt:53)
        at androidx.core.app.JobIntentService$CommandProcessor.doInBackground(JobIntentService.java:392)
        at androidx.core.app.JobIntentService$CommandProcessor.doInBackground(JobIntentService.java:383)
        at android.os.AsyncTask$2.call(AsyncTask.java:333)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at java.lang.Thread.run(Thread.java:764)

This error is thrown on purpose when passphrase seems very unreasonably short (< 12 characters). Such pass phrases should not have passed the zxcvbn check, so it's possible that they were not always checked (eg already imported a weaker pass phrase, then trying to back up or something like that).

[DenBond7]

ref https://mail.google.com/mail/u/0/#search/%22Pass+phrase+length+seems+way+too+low%22

[tomholub]

From the emails it looks like it's happening repeatedly. Is it re-trying? Or is each error user-initiated?

[DenBond7]

@tomholub Such errors happen when the app is trying to run a background task to encrypt keys which were wrongly saved (not encrypted - we had a bug when we were creating a key #447). Now when the app is starting it's trying to encrypt that keys in the local database ---> the error is happening --> a new task is scheduling --> when the app is starting we have the same logic. Users don't see any errors but we receive ACRA reports

[tomholub]

You could cancel the background task when no pass phrase is available.

[DenBond7]

@tomholub

You could cancel the background task when no pass phrase is available.

I see we already have that checking:

flowcrypt-android/FlowCrypt/src/main/java/com/flowcrypt/email/service/actionqueue/actions/EncryptPrivateKeysIfNeededAction.kt

Line 55 in 89f3f39

if (TextUtils.isEmpty(passphrase)) {

So it happens only for weak pass phrases.

[tomholub]

We can notify a user about a weak password and propose to change it (to make a backup with a much stronger password)

To keep it simple, you could just show a toast, and force view change to "change pass phrase" view

As for me it'll better to make that in the next release. The current release alredy have a lot of changes

[DenBond7]

@tomholub

To keep it simple, you could just show a toast

What a text should I show?

[tomholub]

Your private key pass phrase is too weak. Please change it in the settings.

…

On Sat, 17 Aug 2019, 15:00 Den, ***@***.***> wrote: @tomholub <https://github.com/tomholub> To keep it simple, you could just show a toast What a text should I show? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#606?email_source=notifications&email_token=ABQDZEPSCIZV2BGC32R3JTDQE7Y5PA5CNFSM4H4US4PKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD4QKVUY#issuecomment-522234579>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABQDZENIXBW3APFN7FQGR23QE7Y5PANCNFSM4H4US4PA> .