jtmaher2 / passwordr-site Goto Github PK

Currently, Firebase complains about a missing privacy policy. This needs to be added.

If there was a browser extension that could also access the Firebase storage, this would be helpful, as it would mean that the user would not have to go to a website, and that the password fields could just get filled out automatically.

This has something to do with the "link.click()" call.
This actually wasn't due to the link.click() call. It was due to there being no "document.body.appendChild(link);" before the "link.click()" call.

Due to Edge not having support for some of the crypto methods that are being used, the encryption does not work in this browser. This makes the entire site unusable to people who only have Edge as their browser (such as users of Windows 10 S).

Because of how, due to Microsoft Edge not supporting the deriveKey() function, it is necessary to restrict the master password to a 32-character limit. Therefore, the user should not be able to create a master password with a password that is greater than 32 characters.

It should be possible to export passwords into a KeePass-friendly CSV list.

There should be support for sign in providers other than Google.

There should be a "sort by" feature that lets the user sort the passwords by categories such as "Name," "Creation Date" or "Type." "Creation Date" and "Type" would require additional columns to be added to the database.

The setTimeout call can prematurely sort the passwords if the decryption takes more than 1 second. Instead of this, there should be a way to keep track of the number of passwords that have been decrypted, and wait to sort them until this is the same as the total number of passwords.

To reproduce:

1. Sign in
2. Sign out
   2.5) (optional) Close and re-open your browser
3. Sign in again
4. You will see that you will get signed in without being asked for your password

If any of the fields fail to decrypt, the list will not be sorted due to there being less than the maximum number of decrypted fields. To fix this, the numDecrypted counter should be incremented even if a field fails to decrypt.

1. Sign into the site
2. Close the tab/browser, or navigate to a different site, without signing out
3. Return to the site
4. You will see that the "Sign in with Google" button appears even though you are already signed in

This is because " is the default text qualifier in KeePass' Generic CSV Importer.

Anything related to the HIBP API should be optional, and should only be enabled if the user says it should be through the settings menu, which needs to be added.

This is necessary, because of how KeePass' CSV Import feature, by default, uses the newline character as the separator for entries. This means that, if there is a newline in one of the field, KeePass will think that whatever is after this newline is the beginning of a new field.

Instead of logging the user in, the app just goes back to the sign-in activity.

If a note-less password is edited by clicking the "Edit" button, the note field will fail to appear. Additionally, if the user clicks the "Done" button, the following error will be thrown:

Uncaught TypeError: Cannot read property 'value' of null at Passwordr.saveChanges (main.js:774)

The Have I Been Pwned API can be used for this.

There should be a search box in the upper right corner that dynamically adjusts the password list as words are typed/removed.

There should be a "Last logged in: " header at the top of the page when the user signs in.

I am reopening this, because it seems that the date that is displayed is the current date, and not the date that the user last logged in.

There should be a way to pair a Web Authentication API security key, such as the Yubikey Security Key, with the site.

Title says it all

1. Click "Change Password"
2. Change your master password
3. Attempt to decrypt passwords by entering new master password
4. You will see a "Decryption Error" message, and none of the passwords will be decrypted

1. Load the site, and note the minimal space between the buttons and the password list
2. Click the "Sign in with Google" button, and wait for it to sign in
3. Note that there is additional space between the buttons and the password list that was not there before signing in. This appears to be due to the "firebaseui-callback-indicator-container" progress indicator still being present in the background after the user signs in.

0. Open Microsoft Edge, and go to password-3917b.firebaseapp.com
1. Log into an account that has no passwords
2. Type in your master password
3. You will see that the browser tab will crash

In order for the encrypted passwords to be compatible with Android, the maximum digit of each encrypted value must be 127. Anything higher than this will not fit in a single Java byte data type.

Today, I tried to import 251 passwords in JSON format. Only 113 of them got imported.

The page refreshes before the calls to encrypt() have completed.

If the user already has passwords and other data stored in a different password manager (e.g. KeePass), he/she should be able to import this data into Passwordr. The data can be stored in a format such as XML that is easy to parse. Likewise, there should be a way to export all passwords and other data into a format such as XML, so that the user can download it to his/her device.

When the user is making a new password, there should be a button that, if pressed, automatically fills in the password field with a bunch of random characters.

This happens, because the JavaScript function for decoding AES encryption is really slow. To fix this, the password, URL, name, and note fields should be initially hidden (display: 'none';). They should only be set to visible (display: '';) once everything has been decrypted.