Saved Passwords Disappear After App Close/Reopen

[superjet1268]

Preliminary checklist

• I have read the README.
• I have searched the existing issues for my problem. This is a new ticket, NOT a duplicate or related to another open issue.
• I have updated Cromite to the latest version. The bug is reproducible on this latest version.
• This is a bug report about the Cromite browser; not the website nor F-Droid nor anything else.

Can the bug be reproduced with corresponding Chromium version?

Yes

Are you sure?

Yes

Cromite version

version 132.0.6834.83

Device architecture

arm

Platform version

Android 13

Android Device model

Realme Gt Master edition

Is the device rooted?

No

Changed flags

No flags changed

Is this bug happening ONLY in an incognito tab?

No

Is this bug caused by the adblocker?

No

Is this bug a crash?

No

Describe the bug

Saved Passwords Disappear After App Close/Reopen
(Old saved passwords also missing)

Steps to reproduce the bug

Save new password/close the app and try to open the app. There won't be any password saved on password manager

Expected behavior

All saved passwords would be missing

Screenshots

Details

[t-m-w]

Can confirm that loss of saved passwords is a potential issue for 132.

[uazo]

The legacy password store backend is supported on android but usually disabled
in favor of a downstream implementation. Important: the support for this flag
is planned to be removed in November 2024.

as mentioned in https://source.chromium.org/chromium/chromium/src/+/main:components/password_manager/core/browser/buildflags.gni google has decided to remove the internal chromium store of passwords in android.
This is a decision I support, since passwords are saved unencrypted in android.
I just didn't think they would remove it without an official announcement (which I never read).
my advice is to use software like keepassdx
in the meantime I will check why it does not work

[t-m-w]

This looks related?: 6157381: [UPM] Check USE_LOGIN_DATABASE_AS_BACKEND before removing the db

with use_login_database_as_backend being a new build arg.

I haven't had a chance to try yet but plan to later today.

[uazo]

@t-m-w

thank you, I will check.
it is really absurd that an opensource project has so many closed bugids.

• https://issues.chromium.org/issues/388451842
• https://issuetracker.google.com/issues/367592340
• and many others on the subject

already pointed out but they don't care.
I have an idea how to get around it, but I don't have time to implement it. do you have any?

[t-m-w]

@uazo

I have an idea how to get around it, but I don't have time to implement it. do you have any?

To stop saved passwords from disappearing? Yes, I think so. I just got a chance to try, and it looks like something worked, so now I need to narrow that down. I think it was the related patch I linked + the build arg.

Edit: But then I guess this would still be storing them unencrypted, you're saying? It is in the app's internal data, so not the worst, but...? I haven't dug into resolving that part yet.

[chirayudesai]

: But then I guess this would still be storing them unencrypted, you're saying? It is in the app's internal data, so not the worst

I'll add to this, that on modern Android devices, user data is always encrypted, and due to application sandboxing - other apps wouldn't be able to access cromite's internal data.

So while it's still not ideal in some ways, it's definitely a lot better than doing the same on other platforms.

[uazo]

user data is always encrypted, and due to application sandboxing - other apps wouldn't be able to access cromite's internal data.

sure, but:

• the user has no possibility of modifying the filesystem encryption key
• applications with root access can access the fs sandbox without the user noticing it

therefore I consider it a mitigation

[uazo]

I was finally able to check: the behaviour is due to the kClearLoginDatabaseForAllMigratedUPMUsers flag being active by default.
@superjet1268 as a temporary workaround you can deactivate it in chrome://flags/#clear-login-database-for-all-migrated-upm-users

@t-m-w thanks for pointing that out to me.