From cd26929d3918058adcb914e26ce02577243ba7f1 Mon Sep 17 00:00:00 2001
From: jeffrey-signal <jeffrey@signal.org>
Date: Thu, 14 Aug 2025 12:22:19 -0400
Subject: [PATCH] Prevent password managers from overwriting backup key with
 Signal PIN.

Adding a hidden username field provides additional context for the autofill service, so it knows the username associated with the confirmed PIN should be "Signal PIN" rather than "Signal backup key".
---
 .../securesms/lock/v2/CreateSvrPinFragment.kt   |  5 ++++-
 .../main/res/layout/base_kbs_pin_fragment.xml   | 17 +++++++++++++++++
 ...agment_registration_pin_restore_entry_v2.xml | 17 +++++++++++++++++
 .../main/res/layout/kbs_pin_reminder_view.xml   | 16 ++++++++++++++++
 .../res/layout/pin_disable_reminders_dialog.xml | 17 +++++++++++++++++
 5 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/app/src/main/java/org/thoughtcrime/securesms/lock/v2/CreateSvrPinFragment.kt b/app/src/main/java/org/thoughtcrime/securesms/lock/v2/CreateSvrPinFragment.kt
index 77a5c32185..b24eaea8a4 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/lock/v2/CreateSvrPinFragment.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/lock/v2/CreateSvrPinFragment.kt
@@ -5,6 +5,7 @@ import android.view.animation.Animation
 import android.view.animation.TranslateAnimation
 import android.widget.EditText
 import androidx.annotation.PluralsRes
+import androidx.autofill.HintConstants
 import androidx.core.content.ContextCompat
 import androidx.core.view.ViewCompat
 import androidx.lifecycle.ViewModelProvider
@@ -26,7 +27,9 @@ class CreateSvrPinFragment : BaseSvrPinFragment<CreateSvrPinViewModel?>() {
 
     label.text = getPinLengthRestrictionText(R.plurals.CreateKbsPinFragment__pin_must_be_at_least_digits)
     confirm.isEnabled = false
-    ViewCompat.setImportantForAutofill(input, View.IMPORTANT_FOR_AUTOFILL_NO)
+
+    ViewCompat.setImportantForAutofill(input, View.IMPORTANT_FOR_AUTOFILL_YES)
+    ViewCompat.setAutofillHints(input, HintConstants.AUTOFILL_HINT_PASSWORD)
   }
 
   private fun initializeViewStatesForPinChange() {
diff --git a/app/src/main/res/layout/base_kbs_pin_fragment.xml b/app/src/main/res/layout/base_kbs_pin_fragment.xml
index 75b5b5cd52..33445de164 100644
--- a/app/src/main/res/layout/base_kbs_pin_fragment.xml
+++ b/app/src/main/res/layout/base_kbs_pin_fragment.xml
@@ -47,6 +47,23 @@
             app:layout_constraintTop_toBottomOf="@id/edit_kbs_pin_title"
             tools:text="@string/CreateKbsPinFragment__pins_can_help_you_restore_your_account" />
 
+        <!-- Hidden field to provide context for android autofill services. This helps the password manager associate the PIN field with the username
+            "Signal PIN" and avoid potentially overwriting the "Signal Backups" password with the PIN. -->
+        <EditText
+            android:id="@+id/autofill_username_context"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:autofillHints="username"
+            android:enabled="false"
+            android:focusable="false"
+            android:focusableInTouchMode="false"
+            android:importantForAutofill="yes"
+            android:inputType="none"
+            android:text="@string/ConfirmKbsPinFragment__pin_password_manager_id"
+            android:visibility="gone"
+            app:layout_constraintStart_toStartOf="parent"
+            app:layout_constraintTop_toTopOf="parent" />
+
         <com.google.android.material.textfield.TextInputLayout
             android:id="@+id/edit_kbs_textinputlayout"
             style="@style/Widget.Signal.TextInputLayout"
diff --git a/app/src/main/res/layout/fragment_registration_pin_restore_entry_v2.xml b/app/src/main/res/layout/fragment_registration_pin_restore_entry_v2.xml
index 9f947c0d81..8944d231db 100644
--- a/app/src/main/res/layout/fragment_registration_pin_restore_entry_v2.xml
+++ b/app/src/main/res/layout/fragment_registration_pin_restore_entry_v2.xml
@@ -40,6 +40,23 @@
             app:layout_constraintStart_toStartOf="parent"
             app:layout_constraintTop_toBottomOf="@id/pin_restore_pin_title" />
 
+        <!-- Hidden field to provide context for android autofill services. This helps the password manager associate the PIN field with the username
+            "Signal PIN" and avoid potentially overwriting the "Signal Backups" password with the PIN. -->
+        <EditText
+            android:id="@+id/autofill_username_context"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:autofillHints="username"
+            android:enabled="false"
+            android:focusable="false"
+            android:focusableInTouchMode="false"
+            android:importantForAutofill="yes"
+            android:inputType="none"
+            android:text="@string/ConfirmKbsPinFragment__pin_password_manager_id"
+            android:visibility="gone"
+            app:layout_constraintStart_toStartOf="parent"
+            app:layout_constraintTop_toTopOf="parent" />
+
 
         <com.google.android.material.textfield.TextInputLayout
             android:id="@+id/edit_kbs_textinputlayout"
diff --git a/app/src/main/res/layout/kbs_pin_reminder_view.xml b/app/src/main/res/layout/kbs_pin_reminder_view.xml
index 45b2fd9a39..38e27357e0 100644
--- a/app/src/main/res/layout/kbs_pin_reminder_view.xml
+++ b/app/src/main/res/layout/kbs_pin_reminder_view.xml
@@ -21,6 +21,22 @@
         app:layout_constraintStart_toStartOf="parent"
         app:layout_constraintEnd_toEndOf="parent" />
 
+    <!-- Hidden field to provide context for android autofill services. This helps the password manager associate the PIN field with the username
+    "Signal PIN" and avoid potentially overwriting the "Signal Backups" password with the PIN. -->
+    <EditText
+        android:id="@+id/autofill_username_context"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:autofillHints="username"
+        android:enabled="false"
+        android:focusable="false"
+        android:focusableInTouchMode="false"
+        android:importantForAutofill="yes"
+        android:inputType="none"
+        android:text="@string/ConfirmKbsPinFragment__pin_password_manager_id"
+        android:visibility="gone"
+        app:layout_constraintStart_toStartOf="parent"
+        app:layout_constraintTop_toTopOf="parent" />
 
     <EditText
         android:id="@+id/pin"
diff --git a/app/src/main/res/layout/pin_disable_reminders_dialog.xml b/app/src/main/res/layout/pin_disable_reminders_dialog.xml
index e64abc4db0..bb36b25bad 100644
--- a/app/src/main/res/layout/pin_disable_reminders_dialog.xml
+++ b/app/src/main/res/layout/pin_disable_reminders_dialog.xml
@@ -34,6 +34,23 @@
             app:layout_constraintStart_toStartOf="parent"
             app:layout_constraintTop_toBottomOf="@id/reminder_disable_title" />
 
+        <!-- Hidden field to provide context for android autofill services. This helps the password manager associate the PIN field with the username
+            "Signal PIN" and avoid potentially overwriting the "Signal Backups" password with the PIN. -->
+        <EditText
+            android:id="@+id/autofill_username_context"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:autofillHints="username"
+            android:enabled="false"
+            android:focusable="false"
+            android:focusableInTouchMode="false"
+            android:importantForAutofill="yes"
+            android:inputType="none"
+            android:text="@string/ConfirmKbsPinFragment__pin_password_manager_id"
+            android:visibility="gone"
+            app:layout_constraintStart_toStartOf="parent"
+            app:layout_constraintTop_toTopOf="parent" />
+
         <EditText
             android:id="@+id/reminder_disable_pin"
             android:layout_width="wrap_content"