User feedback

[nerd190]

hi, we spoke over in the Termux feature request, I didnt want to spam their issues so providing some feedback here.
small issue, I remember:

• open app.
• add an entry.
• go to browser, logout of a site, re-login...
• doesnt work.

Is setting a git repo manditory?, I agree its the best way to backup/retrieve/sync, even still, its weird we have entered this info already, its saved, but we cant actually use it yet.

My logic:
As a pass-compatable password manager, I can imagine both you, your contributors and your users will also use pass for CLI usage too, when say, at your PC and/or away from phone. I noticed you are a contributor, I believe its one of the plugins I use.
Whilst I believe that:

• Typing isnt the greatest on a phone.
  (I personally use an 11" tablet, when at home, with an external keyboard too).
• Your app is completely worth it as:
  • Its the best there is!
  • Its compatable with pass.

You must see my view too:

Your app requires:

• Your app (pass is just a pkg within termux, written in shell)
• Another app (open keychain).
• Once I download the other app (open keychain).
• Now I either need to make a new key or use my existing one, like most would, I want to use an existing one.
• Now I need to export my key (from a terminal, i.e Termux)
• Once configured, back to your app.
• Now I setup your app.
• Plus git (that I cant sign into yet as git hasnt been set in your app).
• I can now use this service.

Now think about the Termux feature request we spoke about that allows an android application like yours to provide autofill passwords to CLI apps, thats quite cool, but why do I want a pass-compatable password manager to provide passwords in my terminal when I (you and many others) already use pass?
Using my script from share menu in a website is only a few seconds slower than using your app for signin (caveat it doesnt work for GUI apps, just websites), with my proposed opposite festure, it wouldnt be that much slower.
This way...

• I only need to use one manager, vanilla pass, not another two apps on my phone.
• No additional setup needed, opposed to the yours and open keychain.
• Features of pass:
  • multiline password entries.
  • Plugins allow me to backup or copy any line I want of a multiline entry like keys or secrets (anything), no git required etc.

Dont you agree that allowing Termux itself to be an autofill provider, thus allowing pass or a huge array of passwords managers written in many different languages (like its rust port) to be our password provider instead is possibly a step better?
Now THAT is a killer feature you must agree.

[msfjarvis]

Setting up Git is not mandatory. We suggest users do it, because that allows us to keep their passwords safely in a private directory where other apps can't access it rather than somewhere in their public storage.

If Autofill doesn't work for you, then you're either on a browser that does not support Autofill (If on Chrome you need to be on v89) or are on Android 8, where Chrome cannot handle Autofill properly. If you can give me more information about your Android version and browser I can attempt to help you with something more concrete.

Nuclear disarmament would also be pretty killer thing to have, but not everything is meant to be. Autofill requires a large chunk of code to implement, and Termux will have to devise a way to actually discern regular stdout content from what a user intends to be autofilled. They will also not be able to offer the ability to remember matches like APS, because they will not be building on the pass abstraction, but as a terminal emulator handling arbitrary text. With nothing concrete to actually back it, Termux as an Autofill provider is simply a fever dream. It's also completely out of scope for what Termux' core premise is, but I've entertained the possibility in interest of a more technical reasoning as to why it won't happen.

That all being said, APS is being actively improved to handle all the things you've outlined. We have a tracking issue to properly disable Git for users who wish to handle sync themselves, and we are actively investigating ways to drop our dependency on OpenKeychain for multiple reasons including the hassle of configuring an extra app.

[nerd190]

Hello again!
Thank you for pointing out the vast amounts of work it would take, I agree it is now out of scope, a terminal should focus on terminal based things, not autofill like I would like.

I used to use OpenKeychain and a password manager before, but as someone, like yourself, that has tons of dotfiles and configs already (as a power user, I probably backup/reset more than the average user too) I dont really want more setup/dependencies, whilst I love the convienience of your app, I also love the convienience of one manager works for all.

Like I said, I agree with git usage, just out-of-the-box... it should save passwords in the apps private data directory where normal apps cannot read (only rooted users can) until git is setup, instead of not work until it is setup.

I do think that other, less technically minded users would love the option to not use git though, if I wasnt a nerd, I wouldnt know of github, or have a reason to have an account.

After discussion, it seems that for a nerdy user like myself, so far, just using pass is great, but I cannot doubt that your app is amazing and very fast, the only thing is the extra steps, i.e OpenKeychain app and setup (It doesnt take long to setup and not difficult either) but when I:

• Gotta go back to my terminal to export my key so I can:
  • Setup my GUI password manager (APS) dependency app (OpenKeychain), so that I can then:
    • Setup my GUI password app (APS) which is compatable with my main password (CLI) app...

I'm like... "I think I'll just use my one password manager, with no extra setup or dependencies, and live with the extra 5 seconds it takes me to signin". If I gotta use the terminal to export a key, I'm already in the terminal, so I'd rather just use the terminal, rather than bounce between a terminal and 2 apps (3 processes).

So its seems that whilst I love good ol' GPG, the best implementation of it on Android you are already using, so 2 choices...

• Include your own fork of OpenKeychain, same as the vanilla one, just strip out all the /res folder and include it in APS, advantage: They do a great job keeping it up to date and stable, so you wont have to and we can keep good ol' GPG. Disadvantage: larger app size.
• Instead of relying on another encryption method, or getting too deeply involved in cryotography yourself, the easiest way would be to implement an encrypted volume that we mount/unmount, I have used apps for this before, I will try to find the app that uses Rust! Advantage: volume can be in plain sight of any app, like /sdcard, now we solve the git issue we spoke of, as now I can use apps to sync that mount (if mounted) like nextcloud/owncloud, RCX (rclone app) or traditional cloud clients, plus I can still access these mounts without your app (mount via Termux or ADB!).

Once your app is just:

• Your app (no others needed)
• I dont have to go back to the terminal (if you implemented OpenKeychain I can create keys directly from your app, if you used an encrypted volume I wouldnt need to visit the terminal either)
• A user can add a password straight away and get going (out-of-the-box)

Then it is a truly convienient app indeed, for any type of user.