Connection from untrusted source

[cfinnberg]

Hi,

 

an Enpass dialog window came up a few days ago, requesting to give permission to Telegram to access Enpass. I declined the request, obviously and asked about this in a Telegram github issue opened by other user with the same experience. They denied that Telegram can do that and they invited me to ask here. But anyway I'm bit suspicious about this at the moment.

Is it possible that Enpass incorrectly detects something as an incoming connection from a plugin? Does Enpass developers have some possible explanation to this? Is there any public documentation about the communication protocol between the plugin and Enpass? I would like to study myself how this could have been happened.

 

Thanks in advance.

[Amandeep Kumar]

Enpass uses a secure communication protocol between the browser extension and the desktop application to ensure that any access request is legitimate and user-initiated. It is highly unusual for an app like Telegram to request access through Enpass, as such requests are typically reserved for browser extensions.

Some applications might attempt to communicate with other applications, but rest assured, without explicit authorization from you via Enpass, no other application will gain access to your data.

To assist you further, could you please provide more details about the specific circumstances when this dialog appeared? Additionally, you can enable logging in Enpass to capture detailed information about these requests, which might help us understand what triggered the prompt.

Please let us know if you have any other questions or need further assistance.

#SI-3950

[Amandeep Kumar]

To help us further investigate the issue, could you please provide the following details:

1. Your system's operating system and the version of Enpass you are using.
2. A screenshot of any permission pop-ups you encounter, if possible.

Your assistance will help us in reproducing and resolving the issue more effectively.

[cfinnberg]

Hi,

sorry for the delay. The problem has happened only once, so I am not able to provide any more details at the moment. I will provide them if it happens again. Thanks for your assistance!

 

[lmlmlm]

Hello,

this issue just happened to me with a connection request from my mail software (mailspring). I've managed to capture a screenshot of the request. 

On logs I see many Info rows with:

Info: 1743682803 [Enpass Browser Extension Server]  Browser extension validation failed. 
Info: 1743682873 [Enpass Browser Extension Server]  Browser extension validation failed. 
Info: 1743683237 [Enpass Browser Extension Server]  Browser extension validation failed. 

 I'm using Ubuntu 24.04.2 LTS and Enpass 6.11.6 (1833)

[Amandeep Kumar]

Thank you for sharing the requested information. This will surely be helpful for our backend team in further investigation. Please allow us some time to get back to you with more findings or solutions.

[Tarun Singh Rawat]

To help us assist you more effectively, could you please provide the following information:

• Which email provider are you using with Mailspring (e.g., Gmail, Yahoo, Outlook)?

• If you're using an external email provider (not a Mailspring account), which browser did you use to sign in during the authentication process?

[lmlmlm]

On 4/23/2025 at 12:39 PM, Tarun Singh Rawat said:

To help us assist you more effectively, could you please provide the following information:

• Which email provider are you using with Mailspring (e.g., Gmail, Yahoo, Outlook)?

• If you're using an external email provider (not a Mailspring account), which browser did you use to sign in during the authentication process?

- I'm using 3 Google accounts (2 are @gmail accounts, 1 is Google workspace account) 

- I use Brave Browser v1.78.97

[Tarun Singh Rawat]

We're currently reviewing the issue with the technical team and will share an update soon.

[lmlmlm]

Today it happened the same issue with Telegram

[lmlmlm]

Another application, another connection request

[Tarun Singh Rawat]

Our technical team is informed and is currently investigating the issue. We’ll update you as soon as we receive an update from them.


#SI-3950

[Tarun Singh Rawat]

The Enpass browser extension communicates with the Enpass app via a localhost address. To help us verify which port the Enpass server is using, please follow the steps below on your Ubuntu system:

1.     Open the Terminal.
2.     Run the following command to check if the Enpass app is listening on port 10391: 
    lsof -i:10391
    
3. If there is no output (i.e., the command returns blank), please repeat the command for the following ports:
   lsof -i:10392
   Isof -i:10393
   lsof -i:10394
   lsof -i:10395

Once you've run the commands, kindly share the output with us so we can investigate further.

[cfinnberg]

You can also identify the Enpass port with:

netstat -lnp --tcp | grep "Enpass"

With that I get something like:

tcp        0      0 127.0.0.1:10391         0.0.0.0:*               LISTEN      1492/Enpass

that means that in my case Enpass is listening in port 10391.

[lmlmlm]

Output of  lsof -i:10391

COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
Enpass  4919 lorenzo   29u  IPv4  34976      0t0  TCP localhost:10391 (LISTEN)
Enpass  4919 lorenzo   31u  IPv4 452603      0t0  TCP localhost:10391->localhost:38490 (ESTABLISHED)
brave   5128 lorenzo   21u  IPv4 460871      0t0  TCP localhost:38490->localhost:10391 (ESTABLISHED)

Output of netstat -lnp --tcp | grep "Enpass"

(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 127.0.0.1:10391         0.0.0.0:*               LISTEN      4919/Enpass      

[Amandeep Kumar]

Thank you for sharing the requested information. This will surely be helpful for our backend team in further investigation. Please allow us some time to get back to you with more findings or solutions.