#1740 State independent locking

KeePass_2.x
open
nobody
None
5
2013-06-12
2013-06-12
Meingbg
No

By design, the workspace does not lock after the inactivity timeout if an entry is open for viewing/editing.

It can be argued this is a security flaw, and the design is defended by saying there is no good alternative approach (see http://keepass.info/help/base/faq_tech.html#noautolock).

Let me describe a good alternative: When the database is to be locked and an entry is being edited, check first whether any changes has been made. If not, just close and lock. If changes has been made, save those changes to a new entry in a temporary group (Recycle Bin or a dedicated temporary group). Remember the ID's of the edited entry along with the temporarily saved entry in memory together with the view parameters. When the database is unlocked, the edit dialog can be reopened with the changes made before locking. I can see only upsides with this approach:

  • Unsaved data is not lost
  • No entry is replaced by possibly unwanted changes.
  • There is no need to save the database to a temporary location.
  • Even though locking actually closes the database, the user experience is correct since "locking" means "let me continue later where I was, but require a password"

Maybe this behaviour should only be activated if the option "Automatically save database when KeePass closes or the workspace is locked" is enabled. If it is not enabled, maybe the changes can be encrypted and stored in memory instead.

Although this might be considered a feature request, I posted it as a bug because it's a security concern for some.

Discussion

  • Dominik Reichl
    Dominik Reichl
    2013-06-12

    Temporarily remembering data entered in dialogs would be extremely complex. Keep in mind the issue not only arises with the entry dialog, but all dialogs. It would be highly complicated to restore multiple opened dialogs with possibly modified data when unlocking (e.g. consider 'Add Entry' -> add auto-type association, or 'Triggers' -> 'Add' -> tab 'Actions' -> 'Add').

    If anyone wants to implement this as a plugin, feel free to do so.

    Moving to feature requests (as everything's working as expected).

    Best regards,
    Dominik

     
  • Dominik Reichl
    Dominik Reichl
    2013-06-12

    Ticket moved from /p/keepass/bugs/1126/