Can't load GDrive based database with Privacy Screen on

[Varusal]

On the GDrive App there is the option to use FaceID (Settings > Privacy Screen).
If this option is enabled, KeePassium is unable to load the cloud based database.

Steps to reproduce the behavior:

1. Open Google Drive App
2. Tap on the burger menu (three vertical lines)
3. Go to Settings > Privacy Screen
4. Enable Privacy Screen
5. Open KeePassium
6. Load cloud based database

Expected behavior:
KeePassium should prompt the FaceID for GDrive and load the Database.

Screenshot

• Device: iPhone XS
• OS: iOS 14 Dev Build 1
• KeePassium App Version: 1.13.62
• Google Drive App Version: 4.2020.24202

[keepassium]

This is a technical limitation of the file provider framework in iOS.

When Google Drive is protected by a Privacy Screen, it does not serve files to other apps. These apps (such as KeePassium) don't get much information about why the file is not available, so they cannot even know that the issue is related to the Privacy Screen.

Passcode-protected Dropbox has the same issue. Thankfully, they are more upfront and show a corresponding message in the file picker dialog:

Passcode Lock is Enabled
Files cannot be used with a passcode. If you would like to use Files, please open Dropbox and disable Passcode Lock.

All of this happens between the file provider app and the system, way outside of KeePassium's code. Google would be in a better position to address the issue, but they will surely point that this is a system limitation...

[Varusal]

That is true I guess but Apps like WPS Office still work even with Privacy Screen on.
Which I think is because WPS Office uses OAuth to verify itself as an app and I manually need to sign in and grant permission (one time only). This approach is better than the current KeePassium implementation and works without limitations.

[keepassium]

WPS Office uses OAuth to verify itself as an app and I manually need to sign in and grant permission (one time only). This approach is better than the current KeePassium implementation and works without limitations.

This approach allows WPS Office to access your Google Drive directly and do anything it wants with your files. This is too wide a permission for an office suite.

KeePassium is an offline app. It does not perform any network connections, and never will. This is by design. The app won't ask you for your server/cloud credentials; it only has a limited access to few user-selected files. Yes, this means that some features will never happen and that synchronization won't work in some configurations — but staying offline is critically important for user trust.

[Varusal]

But Google offers a wide variety of scopes that can be adjusted.

Yes, KeePassium is an offline app but if you use a cloud database which requires a connection, it isn’t offline anymore.
Also I think there is always the possibility to cache the database and giving the user the option to set intervals for refreshing.

I understand where you come from but it would be a possible solution, at least in my eyes.

[keepassium]

But Google offers a wide variety of scopes that can be adjusted.

Sure, but this is not necessarily the case for other file providers.

but if you use a cloud database which requires a connection, it isn’t offline anymore.

It is still offline.

Google Drive app is responsible for synchronizing its files with the cloud. These files are exposed to the system via the file provider extension. The system serves as a mediator between KeePassium and Google Drive app.

KeePassium ↔︎ system ↔︎ Google Drive app ↔︎ Google cloud 

When you select a file in the standard file picker dialog, the system gives KeePassium a permission to access that one file. For KeePassium, this is just a standard file. When KeePassium tries to open a database, the system activates GDrive to fetch and serve the file. When KeePassium saves the database (as any other local file), the system detects the change and notifies GDrive that the file has changed. (The link in my previous response describes this in more detail.)

Here's an experiment:

• Open system settings → Mobile data, and turn off the switch next to KeePassium
• Turn off Wi-Fi and switch to mobile data
• Edit a cloud-based database in KeePassium
• Check that the database has been updated in the cloud

The app was forced offline (no Wi-Fi or mobile data connection), yet the database has been uploaded. Now, if you turn off network connections for Google Drive — KeePassium won't even open the database. It will display the error message from the system: "Couldn't communicate with a helper application" (Google Drive being the "helper").

So, yes: KeePassium is an offline app with cloud sync :)

[cappert]

Can we use the share sheet to open the file in KeePassium or do we hit the same issue?

…

But Google offers a wide variety of scopes that can be adjusted. Sure, but this is not necessarily the case for other file providers. but if you use a cloud database which requires a connection, it isn’t offline anymore. It is still offline. Google Drive app is responsible for synchronizing its files with the cloud. These files are exposed to the system via the file provider extension <https://developer.apple.com/documentation/fileprovider>. The system serves as a mediator between KeePassium and Google Drive app. KeePassium ↔︎ system ↔︎ Google Drive app ↔︎ Google cloud When you select a file in the standard file picker dialog, the system gives KeePassium a permission to access that one file. For KeePassium, this is just a standard file. When KeePassium tries to open a database, the system activates GDrive to fetch and serve the file. When KeePassium saves the database (as any other local file), the system detects the change and notifies GDrive that the file has changed. (The link <https://keepassium.com/articles/cloud-sync-sandboxing/> in my previous response describes this in more detail.) Here's an experiment: - Open system settings → Mobile data, and turn off the switch next to KeePassium - Turn off Wi-Fi and switch to mobile data - Edit a cloud-based database in KeePassium - Check that the database has been updated in the cloud The app was forced offline (no Wi-Fi or mobile data connection), yet the database has been uploaded. Now, if you turn off network connections for Google Drive — KeePassium won't even open the database. It will display the error message from the system: "Couldn't communicate with a helper application" (Google Drive being the "helper"). So, yes: KeePassium is an offline app with cloud sync :) — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#110 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAARK5ZNFQSXS46ARF66DT3RYYKOBANCNFSM4OJ7ROMA> .

[Varusal]

Can we use the share sheet to open the file in KeePassium or do we hit the
same issue?

@cappert Doesn't work for me. As soon as I tap "open in KeePassium" (in the google drive app), the KeePassium app opens and closes itself.

@keepassium are there any cache settings? Because right now I have Privacy Screen enabled and I'm still able to open the database in KeePassium, even works if I close the database and reopen it.

EDIT: Just tested it. If I add a new entry (on windows) and save the database, even that will be sync with the database I've opened in KeePassium. Something doesn't feel right about that. Why does it work now but after about 24h it doesn't work with Privacy Screen on?

[keepassium]

Can we use the share sheet to open the file in KeePassium or do we hit the same issue?

From the Files app, the share sheet won't be available: instead of files, Google Drive location shows "Authentication required".

From Google Drive itself, the share sheet would simply download the database and export it to KeePassium as a local file. This database won't be linked with Google Drive anymore, so 1) yes, it will open just fine, but 2) it won't sync.

(How do I know that? Because the icon in GDrive's share sheet is titled "Copy to KeePassium" instead of "Open in KeePassium". The first one means the "export" mode, the second means the "open in place" mode.)

are there any cache settings?

No, there is no in-app caching in KeePassium (yet). Last time I checked, Google Drive did not respect the "available offline" flag when serving files to other apps. That is, when offline, you can export an "offline" file directly from the GDrive app, but not via the Files interface.

Because right now I have Privacy Screen enabled and I'm still able to open the database in KeePassium, even works if I close the database and reopen it.

I guess it is a local file, not linked to Google Drive. Tap the circled "info" button for the database — what does it say in the "File location" field?

Why does it work now but after about 24h it doesn't work with Privacy Screen on?

This question is best directed to the file provider devs, that is GDrive team.

the KeePassium app opens and closes itself.

And this one is my bug... KeePassium tries to show an "Overwrite existing file?" dialog, but does that from a background thread. This will be fixed in the next beta.

[Varusal]

I guess it is a local file, not linked to Google Drive. Tap the circled "info" button for the database — what does it say in the "File location" field?

It says "Cloud storage / Another app" screenshot

Also thanks for helping me out and provide a more in-depth look how everything works.

[keepassium]

It says "Cloud storage / Another app"

Hmm, I stand corrected. You are right, the database is indeed in Google Drive.

So, the working hypothesis is that Privacy Screen cuts out file access after some time?

[Varusal]

It says "Cloud storage / Another app"

Hmm, I stand corrected. You are right, the database is indeed in Google Drive.

So, the working hypothesis is that Privacy Screen cuts out file access after some time?

Yes, exactly.
I just re-enabled Privacy Screen and will let you know when the database will no longer be loaded (in the next day or two).
It could be that Google has a certain threshold in which connections will still be possible with Privacy Screen on, at least that is my guess.

[keepassium]

To add more confusion, the test in the Privacy Screen settings says:

Privacy Screen may not protect: [...]

• Files shared with the Files app.

"May not" is a very interesting choice of words. Does they mean that Privacy Screen is designed to interfere with file access? or not to interfere? or does its best to interfere but sometimes fails? :)

Let's see what your experiment shows...

[Varusal]

Here you can see that it doesn’t work with privacy screen on after some time.Video 1

And here you can see that I still can access the file after enabling privacy screen. Video 2

Just found out that the GDrive connection doesn’t work if I want to include a different file. Video 3

So than I also found out that if I use the recently tab, I can load the file without any problems but if I go to details and try to open the location of the file, it takes me back to the authentication required screen. Video 4

At this point it is definitely a Google Drive issue. Even recently used files should not be accessible without FaceID. Basically it is possible to completely bypass Googles Privacy Screen in this scenario also I see a lot more than just .kdbx files.

[keepassium]

Thank you for the detailed investigation!

Circumventing the Privacy Screen via Recent files is quite funny :) But it makes sense from the technical side: as Apple explains here, the Recent tab shows an index maintained by the system. When the user opens the Recent files, the file provider (Google Drive) is not even invoked. So they cannot do anything about it, either.

Since we agree this is a Google Drive issue, I guess we can close this one.