1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
+++
title = "Security"
date = 2026-11-05T00:00:00Z
description = "What HardenedPass protects, where each secret lives, what it sends over the network and which threats it does not cover."
weight = 100
draft = false
+++
This page says what the app does for you and, just as important, what it does not do.
## Where your secrets live
| Secret | Where it is | How it is protected |
|---|---|---|
| Entries | Files in the app's private storage, and on your git server | OpenPGP, the same as `pass` on a computer |
| OpenPGP private key | The app's private storage | Its own passphrase |
| Key passphrase | Nowhere, unless you enable caching | If cached: AES-GCM under an Android Keystore key |
| Git and proxy passwords | The app's private storage, if you tell it to remember them | AES-GCM under an Android Keystore key |
| SSH key made on the phone | Android Keystore | The system, plus your screen lock if you ask for it |
| SSH key you imported | The app's private storage | Its own passphrase, if it has one |
Android Keystore keys are held by the system and cannot be copied out of the phone, even
by the app that uses them.
## What the app does
- **No telemetry.** No analytics, no crash reports, no Google Play Services. The app
only connects to the git server you configured, and to your proxy if you set one.
- **Keeps logs on the phone.** Nothing is sent anywhere. **Export log** writes a file only
when you ask, to the place you choose. The app does not log passwords or keys, but the
file can show entry names, websites, apps and your git server, so read it before sharing
it.
- **Blocks screenshots of secrets.** Entries, the editor, the generator, passphrase
dialogs and autofill windows cannot be captured by screenshots, and do not appear in
the recent apps view.
- **Clears the clipboard.** A copied password is removed after a timeout.
- **Checks the SSH server.** The server's host key is saved on first connection and
checked after that. The first connection is trusted without asking, so make it on a
network you trust.
- **Trusts known browsers only.** Autofill works only in browsers whose signing
certificate the app recognizes, and warns you if an app's publisher changes. See
[Autofill]({{< relref "/hardenedpass/using/autofill" >}}).
- **Refuses outside files.** Other apps can open the app, but it only opens paths that
really are inside your store.
## What the app does not protect you from
- **A compromised phone.** Malware that controls an unlocked phone can see what you
see. Keep the system up to date.
- **Your keyboard.** A keyboard app sees everything you type, the passphrase included.
Use one you trust, with network access off if your system allows that.
- **Other apps reading the clipboard** before the timeout runs out. Autofill avoids the
clipboard altogether.
- **A weak passphrase.** If someone gets your key file, the passphrase is all that is
left.
- **Your git server seeing names.** Entry and folder names are file names, and they are
not encrypted, so the server can read them, along with the dates of your commits.
- **Biometric lock as encryption.** **Enable biometric authentication** is a gate at app
start. It keeps out someone holding your unlocked phone for a moment, and it does not
encrypt anything.
- **Losing your key.** No one can recover a store without its private key and passphrase.
## Passphrase caching
Caching is convenient, but while the passphrase is cached, anyone who gets into the
unlocked app can open every entry. It is experimental. If you use it, turn on
**Automatically clear passphrase cache** as well.
## Reporting a vulnerability
If you find a security problem in the app, do not open a public issue. Email
<danix@danix.xyz>, encrypted to the maintainer's OpenPGP key if you can:
```
110E 1B11 1BA2 C3C7 CCD1 27B8 F96B 36CA CC44 17AE
```
`gpg --locate-keys danix@danix.xyz` fetches it. Check that the fingerprint matches. The
details are in the repository's
[SECURITY.md](https://github.com/danixland/HardenedPass/blob/master/SECURITY.md).
|
