-
Notifications
You must be signed in to change notification settings - Fork 135
Passkey Backup Eligibility flag is always set to true #444
Description
Description
Howdy, KeePassXC lead developer here. We recently got a bug report that highlighted a deficiency in our passkey implementation. Looks like we both hard code the value of Backup Eligibility (BE) but do it differently. I noticed in your code that your authentication data is always set to true for all flags based on some bit logic:
KeePassium/KeePassiumLib/KeePassiumLib/db/passkey/Passkey.swift
Lines 286 to 290 in 4e24164
| let flags = AuthDataFlags.at | |
| | AuthDataFlags.uv | |
| | AuthDataFlags.up | |
| | AuthDataFlags.be | |
| | AuthDataFlags.bs |
We need to introduce a new parameter in the advanced attributes to store the value of the Backup Eligibility, OR, we need to agree on which value to send to relying parties. This will cause problems if we all of a sudden switch this up on users as shown in the parent issue that started all this: pocket-id/pocket-id#397
How to reproduce
Steps to reproduce the behavior:
- Create passkey in either KeePassXC or KeePassium
- Try to use the passkey on a site being strict about BE with the other app
- Login will fail
Expected behavior
We should have consistency with our BE flag by declaring its state at time of creation and storing that declaration.