Ivarson

LinkedIn used to provide a link to login with passkeys, worked fine with Enpass.

Now they (LinkedIn) changed the flow so that a floating popup appears, reading 'login using key', when focusing on the username or password-field.

That popup however brings up Windows native login-screen (device, pin etc) and bypasses Enpass' Passkey-integration.

If more sites follow this, you might have a growing issue at hand.

For Edge and Firefox, i dont event get that floating popup at all.

Windows 11, 23H2.

Google Chrome: 122.0.6261.70

Enpass (Microsoft Store): 6.9.4 (1630)

Enpass Chrome-plugin: 6.9.3

@Amandeep Kumar

Any enpass version on any platform. 

The only possibility to see what category an item belongs to, is to see an item directly from a choosen category. 

If you view an item from the All categories view, there's no field or description to correlate the item back to is category. 

You aren't supposed to move the enpassdbsync AFAIK. 

You disconnect your vault from OneDrive A and connect it to OneDrive B-account? 

This isn't an official package, is it?

Try the Deb-packages from Enpass official Ubuntu repo instead 

"KNOWN ISSUES: - Browser extension unable to connect to application with default permissions. - The extensions will open the application, but not establish a connection." 

- https://flathub.org/apps/io.enpass.Enpass

49 minutes ago, zorixxe said:

How to I change my primary vault from icloud to google drive?
As I no longer have any apple products and they refuse to have sms auth I wont be able to even log in to my Icloud when I stop using my last devide, so switching my enpass to google drive would be the best option.

But how do I switch the primary vault?

vaults are local-first in Enpass. What you'd do is to remove the data "from cloud" on one of your devices with Enpass, then immediately setup a new sync to Google.

If you've got Enpass on more devices still syncing towards apple, youll get a red warning on them saying no data was found on Apple iCloud, ignore and then setup sync to Google on them as well.

make sure you've got backups when doing this, esp. if you're only using Enpass on one device, either automatic ones or create a manual backup, since you'll remove 

Working with vaults — Enpass User Manual-Desktop 6.7 documentation

On 12/21/2023 at 4:43 PM, Mohit Thapa said:

I extend my sincere apologies for any inconvenience caused and want to update you that the Enpass Technical team is actively looking into the issue. As part of this investigation, I have been assigned to gather additional information from users here, enabling us to conduct a more comprehensive analysis. Your cooperation and input in this matter are highly valued and appreciated-

Can you launch https://license.enpass.io in a browser and share the certificate details? It should have same fingerprint as in the image below:
 

 

 

Just tell the devs to stop this malarcy with. It's redicioulus esp. with Enpass going Enterprise.

Pinning was introduced after a security audit you had done prior to Enpass Business, but surely you fixed the real issues that came to light?

Continuing SSL/TLS-pinning for now is just security by obscurity :-)

The new beta version 6.9.4 for android seems to lock the main app when it is brought to focus (and if the "lock after" has been set), not in the background.

I'm seeing my items briefly before enpass lockscreen covers it. So it seems the data is unprotected in the background.

The behavior is seen when "Lock on leave" is disabled.

If that setting is activated, the locking seems to happen as soon as the app is put to background.

Thanks for putting your hands on the WearOS app in enpass beta 6.9.4 for android. 

Seems that you tried to sort the scrolling out. However now you made the title-header scrollable, so items are hidden. 

Please make it so that there is only one scrollable area in the WearOS app (and also not 50% too long scrollbars

Are those plans still "current", that is, you're abandoning the portable version? 

Will it receive functional updates at some point, or security updates if needed, or is it left as-is? 

Is it safe to use in a sync-scenario when other enpass versions are years newer? 

On 12/13/2023 at 4:26 PM, Mohit Thapa said:

Hey @Ivarson
Enpass Technical Team has informed me that the issue is a result of the recent Chrome browser update (version 120.0.6099.43). Indeed, the passkey was functioning correctly until the latest update. Our dedicated team is actively investigating to identify the root cause of the problem. I will keep you informed as soon as a resolution is found.

Checked again now, and seems that this has been solved by Google with yet another Chrome update: 120.0.6099.115. 

Enpass now shows up at Passkey-logins like it should. 

Any idea what's going on? 

Worked fine the other day, logged on to Nintendo, github, passkeys.io Google, so forth. 

But now I get a new seemingly Android-native prompt when I try to use passkeys. 

Chrome://flags still says "Use passkeys for Google Password Manager and third party managers" 

Reboot didn't help. 

Google Pixel 7,

Android 14,

Chrome 120.0.6099.43

Enpass 6.9.3.892

As enpass supports multiple vaults, it would be need if accent colors could be associated with a vault, in the same pane as the name and icon is set.

Then, in the "All Items" view, when all vaults are selected, the items would have the same accent color as its background.

Easier to spot which items belongs where

I agree with @sbstnzmr here.

It's one thing to utilize SSL pinning, but a completely different thing to force lockout with the 'local' architecture in mind.

At the very least there has to be an official, completely offline method for airgap-activating and maintaining licensing. Especially in the Enterprise-segment this is always an option.

The very same audience would most likely expect Enpass with its nature to have and honor a switch in Settings->Advanced that disables Enpass from initiating outbound network requests to public internet. Staying local with Enpass should be possible.

4 hours ago, Abhishek Dewan said:

Hi @buggystick @Ivarson

Upon a comprehensive examination of the issue from our end, we would like to share that in the latest chrome browser update, chrome has added 2 new options in the flag pop up. Kindly enable the option which says 'Enabled for Google Password Manager and 3rd party passkeys' in chrome://flags. Enabling this option should resolve this concern.

#SI-3542

Confirmed working in chrome for me.

Thanks.

Notably, the option below; "Enabled for 3rd party passkeys" does NOT work

9 hours ago, Abhishek Dewan said:

Hi @buggystick

Thank you for sharing the requested details.

Could you please confirm if you are facing this behavior on just the demo site you mentioned or any other webpages as well? If yes, please share their URL too.

Just tried Github, same issue, using latest Chrome for Android with passkey-support activated.

Passkey creation/login works on Desktop but not on Android.. Button triggers Google Password Manager only, which is empty and not chosen at all in Settings --> Passwords

On 11/13/2023 at 8:54 PM, buggystick said:

I recently got a Pixel 8 (Android 14) and wanted to test the new passkey credential storage API with enpass.  I had to modify my chrome://flags for my browser (Brave) to enable the API and was able to successfully create a passkey in enpass for the passkeys.io demo site.  However when I try to login with that passkey, it doesn't give me the option to use enpass and says that my phone doesn't have a passkey for that site as if it's only trying the default google client.  I do have enpass selected as my passkey service in android settings.  Interesting enough, I can use the enpass stored passkey on desktop though.

Was logging in to file the very same glitch 'til I saw this.

Got the same device, same Android- and Enpass-version, tried the same site.

NOW it is published.. magic.

I actually don't understand if the auto-fill vulnerability applies to the Firefox-extension.

Today i noticed via the appmanifest-checkup that you have Firefox-extension 6.8.8 published and available on dl.enpass.io.

It is however not covered on your Download-site.

I installed it and it works. Is it going to be properly published?

In Enpass 6.9.0 stable builds, the websites favicon doesnt show anymore within inline autofill.

This applies to both Windows (UWP) and Linux (RPM) and both extension versions  6.8.3 and 6.8.6

Tried with Chome, Firefox and Edge. Enpass extension 6.8.3 on Firefox and 6.8.6 in Chrome.

Tried to disable and re-enable 'website icons' in Enpass and relaunch with no avail

Why is the extensions for Firefox still at 6.8.3 while all other browser has 6.8.6

6.8.6 - Changelog

• Auto-fill vulnerability related to embedded iframes when “Autofill on page load” is enabled in extension settings.
• Auto-fill problem on Synology reported by a few of you.
• Inline menu showing password generator when trying to autofill.

https://www.enpass.io/release-notes/enpass-browser-extensions/

The portable versions lags behind even more..

23 minutes ago, Abhishek Dewan said:

Hi @chnandler_bong

The 2FA feature is specifically accessible to users with the Enpass Premium version of the license. To address this matter, kindly generate a new support ticket at support@enpass.io and provide the email address used for the license purchase, along with the purchase receipt. Additionally, make sure to reference this forum in your ticket, and I will personally oversee the investigation process for you.

The TOTP-functionality isn't just for Premium is it? it's the Audit-stuff including 2FA that is preserved for Premium.

TOTP is calculated based on the local time on each device. Please check and adjust and make sure they're the same

6 minutes ago, AnakinCaesar said:

The thing is, you cannot store them under one cloud account. You have to use different clouds for each vault. Only WebDAV allows for same-cloud sync

Obviously? that's why merging 5 vaults into 1 is an option if it is sufficent measures for op.