Sensitive Fields not Hidden in 6.8.1

[Matt Miller]

Sometimes when giving the app focus after working in a different program, certain sensitive fields are not hidden. If I click the eyeball icon next to the field then it will hide, but later, when I need to copy the password again, the password is showing again. If I were doing a screen share when that happened I'd have to immediately change that password!

I've not seen a pattern that consistently triggers this, but it happens fairly often.

[Gulshan Dogra]

Hi @Matt Miller,

Thank you for reaching out to us.

Please share the following details so that I can get this issue investigated by our concerned team.

1. On which device (along with the OS version) you are using Enpass?
2. The Enpass version you are using is it downloaded from store or website?

[Matt Miller]

System information:

OS Name    Microsoft Windows 10 Home
Version    10.0.19044 Build 19044

Enpass information: 6.8.1 (1060)

I don't remember if I downloaded Enpass from the Microsoft Store or from the Enpass website, but if I go to the Microsoft Store app and search there for "Enpass," the store reports Enpass as "Installed." So, I guess I installed it from the store.

[Gulshan Dogra]

@Matt Miller,

Thanks for sharing the details.

I have duly noted your feedback and it has been forwarded along with your details to our concerned team for further investigation. Can you please share that while switching between applications, do you use the "ALT+TAB" command? That would cause this problem.

#SI-2901

[c74a]

Hello @Gulshan Dogra,

I'm experiencing the same effect as @Matt Miller.

The sensitive fields show their content as soon as you press the ALT-Key. If you release the ALT-key, the sensitive content is hidden again.

If the Enpass application window has the focus and you use ALT+TAB to switch to another application, the content of the sensitive fields remains visible even after you release the ALT-key.

From my perspective this is a big flaw and even a security issue. I cannot see any valid reason why you should show the content of sensitive fields by pressing the ALT-key. And the behaviour when using ALT+TAB is even more weird.

Please fix this ASAP or at least make the behaviour configurable.

Kind regards,

c74a

Edited June 5, 2022 by c74a

[c74a]

PS

Just tried this on a Mac (MacBook Air M1, macOS 12.4):

The sensitive fields show their content when the ALT/option key is pressed.

Since command-key+TAB is used to switch windows on macOS, I couldn't reproduce the effect that the sensitive content remains visible even after the option key was released.

However, seems to me that both Windows and macOS versions are in need of a fix.

[Gulshan Dogra]

Hi @c74a,

We appreciate you taking the time to share your feedback with us.

I have noted your device details and have forwarded your reply to our backend team for further investigation. Any updates from the team will be communicated to you shortly. 

#SI-2901

[Gulshan Dogra]

Hi @Matt Millerand @c74a,

I would like to share that issue has been reproduced on our end and our team is working on it, it will be fixed in the future updates of Enpass. In the meantime, we appreciate your patience and support.

#SI-2901

[EmPath]

Tossing my hat into the ring for this one. I signed up just for this reason. It is a security issue that did not exist until a recent update.

The best fix here is to remove the "Alt" key shortcut entirely, as that will result in a quick-fix and turnaround. Nobody will complain about the loss of a feature that nobody uses, particularly when it causes a security bug.

This should be included in a quick-turnaround patch release and NOT wait for a feature release.

Edited June 17, 2022 by EmPath

[Jameswalter]

Select the field you're looking to modify. Then, select “View Field Accessibility”. From the drop down, select the field you're interested in hiding. That will reveal a list of all your Profiles and their current access level.