From b1f067536b9ce642077fdd9e9b6fc34d7aa20c0d Mon Sep 17 00:00:00 2001 From: jeffrey-signal Date: Thu, 4 Sep 2025 16:21:56 -0400 Subject: [PATCH] Disable saving PIN to password manager. We haven't found a reliable way to make the auto-fill framework differentiate between the PIN and backup key, so we are disabling prompts to save Signal PINs to password managers to avoid accidentally overwriting a saved backup key with a PIN value. Co-authored-by: Michelle Tang --- .../app/account/AccountSettingsFragment.kt | 14 ++++++------- .../ChangeNumberRegistrationLockFragment.kt | 6 ++++-- .../lock/SignalPinReminderDialog.java | 9 ++++----- .../securesms/lock/v2/BaseSvrPinFragment.java | 5 +++-- .../lock/v2/ConfirmSvrPinFragment.kt | 20 ------------------- .../securesms/lock/v2/CreateSvrPinFragment.kt | 6 ------ .../pin/PinRestoreEntryFragment.java | 5 +++-- .../RegistrationLockFragment.kt | 5 +++-- .../ReRegisterWithPinFragment.kt | 4 +++- .../RegistrationLockFragment.kt | 6 ++++-- .../ReRegisterWithPinFragment.kt | 4 +++- .../main/res/layout/base_kbs_pin_fragment.xml | 18 ----------------- ...ment_registration_pin_restore_entry_v2.xml | 19 ------------------ .../main/res/layout/kbs_pin_reminder_view.xml | 17 ---------------- .../layout/pin_disable_reminders_dialog.xml | 17 ---------------- .../res/layout/pin_restore_entry_fragment.xml | 1 - 16 files changed, 33 insertions(+), 123 deletions(-) diff --git a/app/src/main/java/org/thoughtcrime/securesms/components/settings/app/account/AccountSettingsFragment.kt b/app/src/main/java/org/thoughtcrime/securesms/components/settings/app/account/AccountSettingsFragment.kt index 1d577d6ec9..86acec02ba 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/components/settings/app/account/AccountSettingsFragment.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/components/settings/app/account/AccountSettingsFragment.kt @@ -4,6 +4,7 @@ import android.content.Context import android.content.Intent import android.graphics.Typeface import android.text.InputType +import android.text.method.PasswordTransformationMethod import android.util.DisplayMetrics import android.view.ViewGroup import android.widget.EditText @@ -13,7 +14,6 @@ import androidx.annotation.ColorRes import androidx.annotation.StringRes import androidx.annotation.VisibleForTesting import androidx.appcompat.app.AlertDialog -import androidx.autofill.HintConstants import androidx.compose.foundation.layout.padding import androidx.compose.foundation.lazy.LazyColumn import androidx.compose.material3.MaterialTheme @@ -31,7 +31,6 @@ import androidx.compose.ui.res.colorResource import androidx.compose.ui.res.stringResource import androidx.compose.ui.res.vectorResource import androidx.core.app.DialogCompat -import androidx.core.view.ViewCompat import androidx.fragment.app.viewModels import androidx.lifecycle.compose.collectAsStateWithLifecycle import androidx.navigation.fragment.findNavController @@ -117,10 +116,10 @@ class AccountSettingsFragment : ComposeFragment() { changeKeyboard.setOnClickListener { if (pinEditText.inputType and InputType.TYPE_CLASS_NUMBER == 0) { - pinEditText.inputType = InputType.TYPE_CLASS_NUMBER or InputType.TYPE_NUMBER_VARIATION_PASSWORD + pinEditText.inputType = InputType.TYPE_CLASS_NUMBER changeKeyboard.setIconResource(PinKeyboardType.ALPHA_NUMERIC.iconResource) } else { - pinEditText.inputType = InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD + pinEditText.inputType = InputType.TYPE_CLASS_TEXT changeKeyboard.setIconResource(PinKeyboardType.NUMERIC.iconResource) } pinEditText.typeface = Typeface.DEFAULT @@ -130,20 +129,19 @@ class AccountSettingsFragment : ComposeFragment() { ViewUtil.focusAndShowKeyboard(pinEditText) } - ViewCompat.setAutofillHints(pinEditText, HintConstants.AUTOFILL_HINT_PASSWORD) - when (SignalStore.pin.keyboardType) { PinKeyboardType.NUMERIC -> { - pinEditText.inputType = InputType.TYPE_CLASS_NUMBER or InputType.TYPE_NUMBER_VARIATION_PASSWORD + pinEditText.inputType = InputType.TYPE_CLASS_NUMBER changeKeyboard.setIconResource(PinKeyboardType.ALPHA_NUMERIC.iconResource) } PinKeyboardType.ALPHA_NUMERIC -> { - pinEditText.inputType = InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD + pinEditText.inputType = InputType.TYPE_CLASS_TEXT changeKeyboard.setIconResource(PinKeyboardType.NUMERIC.iconResource) } } + pinEditText.transformationMethod = PasswordTransformationMethod.getInstance() pinEditText.addTextChangedListener(object : SimpleTextWatcher() { override fun onTextChanged(text: String) { turnOffButton.isEnabled = text.length >= SvrConstants.MINIMUM_PIN_LENGTH diff --git a/app/src/main/java/org/thoughtcrime/securesms/components/settings/app/changenumber/ChangeNumberRegistrationLockFragment.kt b/app/src/main/java/org/thoughtcrime/securesms/components/settings/app/changenumber/ChangeNumberRegistrationLockFragment.kt index b956ad3582..5d0538c8cf 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/components/settings/app/changenumber/ChangeNumberRegistrationLockFragment.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/components/settings/app/changenumber/ChangeNumberRegistrationLockFragment.kt @@ -7,6 +7,7 @@ package org.thoughtcrime.securesms.components.settings.app.changenumber import android.os.Bundle import android.text.InputType +import android.text.method.PasswordTransformationMethod import android.view.KeyEvent import android.view.View import android.view.inputmethod.EditorInfo @@ -287,11 +288,12 @@ class ChangeNumberRegistrationLockFragment : LoggingFragment(R.layout.fragment_c val isAlphaNumeric = keyboard == PinKeyboardType.ALPHA_NUMERIC binding.kbsLockPinInput.setInputType( - if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD - else InputType.TYPE_CLASS_NUMBER or InputType.TYPE_NUMBER_VARIATION_PASSWORD + if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT + else InputType.TYPE_CLASS_NUMBER ) binding.kbsLockPinInput.getText().clear() + binding.kbsLockPinInput.transformationMethod = PasswordTransformationMethod.getInstance() } private fun navigateToAccountLocked() { diff --git a/app/src/main/java/org/thoughtcrime/securesms/lock/SignalPinReminderDialog.java b/app/src/main/java/org/thoughtcrime/securesms/lock/SignalPinReminderDialog.java index 1ab16ed8b5..7b41a04962 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/lock/SignalPinReminderDialog.java +++ b/app/src/main/java/org/thoughtcrime/securesms/lock/SignalPinReminderDialog.java @@ -9,6 +9,7 @@ import android.text.SpannableStringBuilder; import android.text.Spanned; import android.text.TextUtils; import android.text.method.LinkMovementMethod; +import android.text.method.PasswordTransformationMethod; import android.text.style.ClickableSpan; import android.util.DisplayMetrics; import android.view.Display; @@ -21,9 +22,7 @@ import android.widget.TextView; import androidx.annotation.NonNull; import androidx.annotation.Nullable; import androidx.appcompat.app.AlertDialog; -import androidx.autofill.HintConstants; import androidx.core.app.DialogCompat; -import androidx.core.view.ViewCompat; import com.google.android.material.dialog.MaterialAlertDialogBuilder; @@ -74,16 +73,16 @@ public final class SignalPinReminderDialog { SpannableString forgotText = new SpannableString(context.getString(R.string.KbsReminderDialog__forgot_pin)); ViewUtil.focusAndShowKeyboard(pinEditText); - ViewCompat.setAutofillHints(pinEditText, HintConstants.AUTOFILL_HINT_PASSWORD); switch (SignalStore.pin().getKeyboardType()) { case NUMERIC: - pinEditText.setInputType(InputType.TYPE_CLASS_NUMBER | InputType.TYPE_NUMBER_VARIATION_PASSWORD); + pinEditText.setInputType(InputType.TYPE_CLASS_NUMBER); break; case ALPHA_NUMERIC: - pinEditText.setInputType(InputType.TYPE_CLASS_TEXT | InputType.TYPE_TEXT_VARIATION_PASSWORD); + pinEditText.setInputType(InputType.TYPE_CLASS_TEXT ); break; } + pinEditText.setTransformationMethod(PasswordTransformationMethod.getInstance()); ClickableSpan clickableSpan = new ClickableSpan() { @Override diff --git a/app/src/main/java/org/thoughtcrime/securesms/lock/v2/BaseSvrPinFragment.java b/app/src/main/java/org/thoughtcrime/securesms/lock/v2/BaseSvrPinFragment.java index 158df96247..66517e2895 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/lock/v2/BaseSvrPinFragment.java +++ b/app/src/main/java/org/thoughtcrime/securesms/lock/v2/BaseSvrPinFragment.java @@ -3,6 +3,7 @@ package org.thoughtcrime.securesms.lock.v2; import android.content.Intent; import android.os.Bundle; import android.text.InputType; +import android.text.method.PasswordTransformationMethod; import android.view.KeyEvent; import android.view.LayoutInflater; import android.view.Menu; @@ -192,8 +193,8 @@ public abstract class BaseSvrPinFragment private void updateKeyboard(@NonNull PinKeyboardType keyboard) { boolean isAlphaNumeric = keyboard == PinKeyboardType.ALPHA_NUMERIC; - input.setInputType(isAlphaNumeric ? InputType.TYPE_CLASS_TEXT | InputType.TYPE_TEXT_VARIATION_PASSWORD - : InputType.TYPE_CLASS_NUMBER | InputType.TYPE_NUMBER_VARIATION_PASSWORD); + input.setInputType(isAlphaNumeric ? InputType.TYPE_CLASS_TEXT : InputType.TYPE_CLASS_NUMBER); + input.setTransformationMethod(PasswordTransformationMethod.getInstance()); } private @StringRes int resolveKeyboardToggleText(@NonNull PinKeyboardType keyboard) { diff --git a/app/src/main/java/org/thoughtcrime/securesms/lock/v2/ConfirmSvrPinFragment.kt b/app/src/main/java/org/thoughtcrime/securesms/lock/v2/ConfirmSvrPinFragment.kt index de2646694a..0bae4921cb 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/lock/v2/ConfirmSvrPinFragment.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/lock/v2/ConfirmSvrPinFragment.kt @@ -3,14 +3,9 @@ package org.thoughtcrime.securesms.lock.v2 import android.app.Activity import android.content.DialogInterface import android.view.View -import androidx.autofill.HintConstants import androidx.core.content.ContextCompat -import androidx.core.view.ViewCompat import androidx.lifecycle.ViewModelProvider import com.google.android.material.dialog.MaterialAlertDialogBuilder -import kotlinx.coroutines.CoroutineScope -import kotlinx.coroutines.Dispatchers -import kotlinx.coroutines.launch import org.thoughtcrime.securesms.R import org.thoughtcrime.securesms.dependencies.AppDependencies import org.thoughtcrime.securesms.lock.v2.ConfirmSvrPinViewModel.SaveAnimation @@ -18,7 +13,6 @@ import org.thoughtcrime.securesms.megaphone.Megaphones import org.thoughtcrime.securesms.registration.util.RegistrationUtil import org.thoughtcrime.securesms.storage.StorageSyncHelper import org.thoughtcrime.securesms.util.SpanUtil -import org.thoughtcrime.securesms.util.storage.AndroidCredentialRepository internal class ConfirmSvrPinFragment : BaseSvrPinFragment() { @@ -29,9 +23,6 @@ internal class ConfirmSvrPinFragment : BaseSvrPinFragment { @@ -127,14 +117,4 @@ internal class ConfirmSvrPinFragment : BaseSvrPinFragment() { label.text = getPinLengthRestrictionText(R.plurals.CreateKbsPinFragment__pin_must_be_at_least_digits) confirm.isEnabled = false - - ViewCompat.setImportantForAutofill(input, View.IMPORTANT_FOR_AUTOFILL_YES) - ViewCompat.setAutofillHints(input, HintConstants.AUTOFILL_HINT_PASSWORD) } private fun initializeViewStatesForPinChange() { diff --git a/app/src/main/java/org/thoughtcrime/securesms/pin/PinRestoreEntryFragment.java b/app/src/main/java/org/thoughtcrime/securesms/pin/PinRestoreEntryFragment.java index 1a51ee313f..8cfb27576a 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/pin/PinRestoreEntryFragment.java +++ b/app/src/main/java/org/thoughtcrime/securesms/pin/PinRestoreEntryFragment.java @@ -4,6 +4,7 @@ import android.app.Activity; import android.content.Intent; import android.os.Bundle; import android.text.InputType; +import android.text.method.PasswordTransformationMethod; import android.view.LayoutInflater; import android.view.View; import android.view.ViewGroup; @@ -262,8 +263,8 @@ public class PinRestoreEntryFragment extends LoggingFragment { private void updateKeyboard(@NonNull PinKeyboardType keyboard) { boolean isAlphaNumeric = keyboard == PinKeyboardType.ALPHA_NUMERIC; - pinEntry.setInputType(isAlphaNumeric ? InputType.TYPE_CLASS_TEXT | InputType.TYPE_TEXT_VARIATION_PASSWORD - : InputType.TYPE_CLASS_NUMBER | InputType.TYPE_NUMBER_VARIATION_PASSWORD); + pinEntry.setInputType(isAlphaNumeric ? InputType.TYPE_CLASS_TEXT : InputType.TYPE_CLASS_NUMBER ); + pinEntry.setTransformationMethod(PasswordTransformationMethod.getInstance()); pinEntry.getText().clear(); } diff --git a/app/src/main/java/org/thoughtcrime/securesms/registration/ui/registrationlock/RegistrationLockFragment.kt b/app/src/main/java/org/thoughtcrime/securesms/registration/ui/registrationlock/RegistrationLockFragment.kt index d647c43710..8836d16716 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/registration/ui/registrationlock/RegistrationLockFragment.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/registration/ui/registrationlock/RegistrationLockFragment.kt @@ -7,6 +7,7 @@ package org.thoughtcrime.securesms.registration.ui.registrationlock import android.os.Bundle import android.text.InputType +import android.text.method.PasswordTransformationMethod import android.view.KeyEvent import android.view.View import android.view.inputmethod.EditorInfo @@ -275,11 +276,11 @@ class RegistrationLockFragment : LoggingFragment(R.layout.fragment_registration_ val isAlphaNumeric = keyboard == PinKeyboardType.ALPHA_NUMERIC binding.kbsLockPinInput.setInputType( - if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD - else InputType.TYPE_CLASS_NUMBER or InputType.TYPE_NUMBER_VARIATION_PASSWORD + if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT else InputType.TYPE_CLASS_NUMBER ) binding.kbsLockPinInput.getText().clear() + binding.kbsLockPinInput.transformationMethod = PasswordTransformationMethod.getInstance() } private fun sendEmailToSupport() { diff --git a/app/src/main/java/org/thoughtcrime/securesms/registration/ui/reregisterwithpin/ReRegisterWithPinFragment.kt b/app/src/main/java/org/thoughtcrime/securesms/registration/ui/reregisterwithpin/ReRegisterWithPinFragment.kt index 926d7be990..e9c5762ad4 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/registration/ui/reregisterwithpin/ReRegisterWithPinFragment.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/registration/ui/reregisterwithpin/ReRegisterWithPinFragment.kt @@ -7,6 +7,7 @@ package org.thoughtcrime.securesms.registration.ui.reregisterwithpin import android.os.Bundle import android.text.InputType +import android.text.method.PasswordTransformationMethod import android.view.View import android.view.inputmethod.EditorInfo import android.widget.Toast @@ -201,8 +202,9 @@ class ReRegisterWithPinFragment : LoggingFragment(R.layout.fragment_registration private fun updateKeyboard(keyboard: PinKeyboardType) { val isAlphaNumeric = keyboard == PinKeyboardType.ALPHA_NUMERIC - binding.pinRestorePinInput.inputType = if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD else InputType.TYPE_CLASS_NUMBER or InputType.TYPE_NUMBER_VARIATION_PASSWORD + binding.pinRestorePinInput.inputType = if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT else InputType.TYPE_CLASS_NUMBER binding.pinRestorePinInput.text?.clear() + binding.pinRestorePinInput.transformationMethod = PasswordTransformationMethod.getInstance() } private fun onNeedHelpClicked() { diff --git a/app/src/main/java/org/thoughtcrime/securesms/registrationv3/ui/registrationlock/RegistrationLockFragment.kt b/app/src/main/java/org/thoughtcrime/securesms/registrationv3/ui/registrationlock/RegistrationLockFragment.kt index b089af19bd..0ed3783d6c 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/registrationv3/ui/registrationlock/RegistrationLockFragment.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/registrationv3/ui/registrationlock/RegistrationLockFragment.kt @@ -7,6 +7,7 @@ package org.thoughtcrime.securesms.registrationv3.ui.registrationlock import android.os.Bundle import android.text.InputType +import android.text.method.PasswordTransformationMethod import android.view.KeyEvent import android.view.View import android.view.inputmethod.EditorInfo @@ -275,11 +276,12 @@ class RegistrationLockFragment : LoggingFragment(R.layout.fragment_registration_ val isAlphaNumeric = keyboard == PinKeyboardType.ALPHA_NUMERIC binding.kbsLockPinInput.setInputType( - if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD - else InputType.TYPE_CLASS_NUMBER or InputType.TYPE_NUMBER_VARIATION_PASSWORD + if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT + else InputType.TYPE_CLASS_NUMBER ) binding.kbsLockPinInput.getText().clear() + binding.kbsLockPinInput.transformationMethod = PasswordTransformationMethod.getInstance() } private fun sendEmailToSupport() { diff --git a/app/src/main/java/org/thoughtcrime/securesms/registrationv3/ui/reregisterwithpin/ReRegisterWithPinFragment.kt b/app/src/main/java/org/thoughtcrime/securesms/registrationv3/ui/reregisterwithpin/ReRegisterWithPinFragment.kt index dd3225ef28..1ba42f301e 100644 --- a/app/src/main/java/org/thoughtcrime/securesms/registrationv3/ui/reregisterwithpin/ReRegisterWithPinFragment.kt +++ b/app/src/main/java/org/thoughtcrime/securesms/registrationv3/ui/reregisterwithpin/ReRegisterWithPinFragment.kt @@ -7,6 +7,7 @@ package org.thoughtcrime.securesms.registrationv3.ui.reregisterwithpin import android.os.Bundle import android.text.InputType +import android.text.method.PasswordTransformationMethod import android.view.View import android.view.inputmethod.EditorInfo import android.widget.Toast @@ -202,8 +203,9 @@ class ReRegisterWithPinFragment : LoggingFragment(R.layout.fragment_registration private fun updateKeyboard(keyboard: PinKeyboardType) { val isAlphaNumeric = keyboard == PinKeyboardType.ALPHA_NUMERIC - binding.pinRestorePinInput.inputType = if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD else InputType.TYPE_CLASS_NUMBER or InputType.TYPE_NUMBER_VARIATION_PASSWORD + binding.pinRestorePinInput.inputType = if (isAlphaNumeric) InputType.TYPE_CLASS_TEXT else InputType.TYPE_CLASS_NUMBER binding.pinRestorePinInput.text?.clear() + binding.pinRestorePinInput.transformationMethod = PasswordTransformationMethod.getInstance() } private fun onNeedHelpClicked() { diff --git a/app/src/main/res/layout/base_kbs_pin_fragment.xml b/app/src/main/res/layout/base_kbs_pin_fragment.xml index 33445de164..db85dc6979 100644 --- a/app/src/main/res/layout/base_kbs_pin_fragment.xml +++ b/app/src/main/res/layout/base_kbs_pin_fragment.xml @@ -47,23 +47,6 @@ app:layout_constraintTop_toBottomOf="@id/edit_kbs_pin_title" tools:text="@string/CreateKbsPinFragment__pins_can_help_you_restore_your_account" /> - - - diff --git a/app/src/main/res/layout/fragment_registration_pin_restore_entry_v2.xml b/app/src/main/res/layout/fragment_registration_pin_restore_entry_v2.xml index 8944d231db..bb1488b202 100644 --- a/app/src/main/res/layout/fragment_registration_pin_restore_entry_v2.xml +++ b/app/src/main/res/layout/fragment_registration_pin_restore_entry_v2.xml @@ -40,24 +40,6 @@ app:layout_constraintStart_toStartOf="parent" app:layout_constraintTop_toBottomOf="@id/pin_restore_pin_title" /> - - - - diff --git a/app/src/main/res/layout/kbs_pin_reminder_view.xml b/app/src/main/res/layout/kbs_pin_reminder_view.xml index 38e27357e0..c5ed022051 100644 --- a/app/src/main/res/layout/kbs_pin_reminder_view.xml +++ b/app/src/main/res/layout/kbs_pin_reminder_view.xml @@ -21,23 +21,6 @@ app:layout_constraintStart_toStartOf="parent" app:layout_constraintEnd_toEndOf="parent" /> - - - - - -