Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Master password change should require current password as verification #1280

Open
thedoc31 opened this issue Aug 7, 2023 · 1 comment
Open
Milestone

Comments

@thedoc31
Copy link

thedoc31 commented Aug 7, 2023

Is your feature request related to a problem? Please describe.
In the KeePass official app, a user is required to type their current password along with the new password and password verification when changing the master password. A password change is not allowed without current password matching. I don't know if KeePass official app shows a "No password is set" message if one isn't set (if it even allows it).

Describe the solution you'd like
MacPass should mirror the KeePass official app behavior

Describe alternatives you've considered
Leave as-is, since the database is already unlocked at the time the password is changed

Additional context
Asking for a current password is consistent with other password change dialog boxes in MacOS, such as the one when I try to change my local Mac user's password. This also helps prevent against changes if a database is left open on a desktop and an attacker/coworker decides to mess with it.
MacOS password change dialog:
image

@mstarke
Copy link
Member

mstarke commented Aug 14, 2023

That's a reasonable request. It should be possible to change this.

On the same topic it might be feasable to require a save afterwards since the password change is not immediate.

@mstarke mstarke added this to the 0.9 milestone Aug 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants