Error loading/saving password generator settings with special character types

[ghost]

1. Start keepassxc, I select the tool: password generator:

Output in the keepassxc.ini file:

[generator]
Braces=false
Dashes=false
EASCII=false
EnsureEvery=true
ExcludeAlike=false
ExcludedChars=
Length=25
Logograms=false
LowerCase=true
Math=false
Numbers=true
Punctuation=false
Quotes=false
SpecialChars=false
Type=0
UpperCase=true
WordCount=7
WordList=eff_large.wordlist
WordSeparator=" "

2. I select the type of characters: special characters, regenerate, close and end keepassxc

Output in the keepassxc.ini file:

[generator]
Braces=false
Dashes=false
EASCII=false
EnsureEvery=true
ExcludeAlike=false
ExcludedChars=
Length=25
Logograms=false
LowerCase=true
Math=false
Numbers=true
Punctuation=false
Quotes=false
SpecialChars=true
Type=0
UpperCase=true
WordCount=7
WordList=eff_large.wordlist
WordSeparator=" "

3. Reopen keepassxc, go to password generator:
   

The changes were not saved.

4. But if instead of leaving keepassxc the password generator opens again:
   

[generator]
Braces=false
Dashes=false
EASCII=false
EnsureEvery=true
ExcludeAlike=false
ExcludedChars=
Length=25
Logograms=false
LowerCase=true
Math=false
Numbers=true
Punctuation=false
Quotes=false
SpecialChars=true
Type=0
UpperCase=true
WordCount=7
WordList=eff_large.wordlist
WordSeparator=" "

6. Regenerate, close and end keepassxc. The changes were not saved.
   

7. In addition there is an additional problem, because if you select the special characters, the groups (in advanced mode): Braces, Dashes, Logograms, Math, Punctuation, Quotes must be activated (true) and not appear activated.
   

Debug Info

KeePassXC - Version 2.4.0-beta2
Build Type: PreRelease
Revision: 9bc20f0
Distribution: AppImage

Libraries:

• Qt 5.10.1
• libgcrypt 1.8.1

Operating system: KDE neon User Edition 5.15
CPU architecture: x86_64
Kernel: linux 4.15.0-45-generic

Enabled extensions:

• Auto-Type
• Browser Integration
• SSH Agent
• KeeShare (only unsigned sharing)
• YubiKey

[droidmonkey]

I've notice this as well. I think the behavior is caused by the fact that the generator starts in "Simple" mode even if you had previously used "Advanced" mode. Putting it in "Simple" mode clears a lot of settings and/or defaults some things. I have also notice that even if in simple mode the password generated can contain advanced mode symbols.

[Frederick888]

Same here. In the entry editing panel, the password generator is always set to

1. the same length as current password
2. although sometimes the special characters button is highlighted, the generated password does not have any special characters in it, no matter how many times I click Regenerate

KeePassXC - Version 2.4.0
Revision: c51752d

Libraries:

• Qt 5.12.2
• libgcrypt 1.8.4

Operating system: Arch Linux
CPU architecture: x86_64
Kernel: linux 5.0.5-arch1-1-ARCH

Enabled extensions:

• Auto-Type
• Browser Integration
• SSH Agent
• KeeShare (only unsigned sharing)
• YubiKey

[droidmonkey]

1 is by design

[Frederick888]

@droidmonkey While I can understand how keeping the generated password of the same length as the current one could be useful (prevent breaking website-specific length limitation, etc.), but imho this may only apply where the current password is already one generated by a password manager.

I have ~500 entries migrated from browser and it'd be both time-consuming and unnecessary for me to update them all at once. So what I do is basically every time I use a website that's saved in KeePass but has not been updated yet, I'd generate a new password for it, and I usually want the generated password to have the same length by default as the old ones are usually shorter than my "standard random passwords".

But since it'd be obviously an overkill to implement such a logic and it won't be able to cover every use case anyway (as a user may have migrated from a different password manager), it'd be nice to have a switch to suppress this behaviour so that worrywarts like me wouldn't be mildly irritated every time cos of passwords slightly shorter than usual 😅

[droidmonkey]

Wish you were around when we debated #2180

[Frederick888]

@droidmonkey LOL...

Well, my idea is not against #2180. Since KeePassXC itself doesn't have the info about limitations of websites, I actually think it can be a nice complement to the browser plugin, but only in certain scenarios, i.e. user started using a password manager from day 1.

I just quickly went through #2180 and I think the function has already been well discussed. If I understand correctly, to make it "perfect" some metadata has to be stored into the database but as not everyone expects the trade-off, it was in the end implemented in a relatively inflexible way.

So what I'm suggesting here is that why don't we leave users a choice then? I understand this is somewhat a trivial setting and if we keep adding such settings to KeePassXC, it may eventually make the configuration panel quite bloated, but that's a different problem then and I guess an advanced configuration interface (like Firefox and Chrome) can help as long as those settings are well documented.

[droidmonkey]

The intention with password profiles is that you would almost "create your own setting" that you can easily choose when generating new passwords. So in your use-case, you would create a profile for "new secure password" which would hypothetically consist of 20 characters, full symbol usage, and perhaps some extended ascii. When you go to upgrade your password you would choose this profile and be on your way. It is far more robust then a setting for use existing password length.

[Frederick888]

@droidmonkey The idea of database-wide password profiles sounds great but I reckon a lot of details still need to be ironed out before it even gets implemented (and considering #2628 has been quiet for a while...). In the meantime however, #2180 can be somewhat a handicap in certain use cases (actually in most use cases I'd say, I can see it being useful for regular password rotations, but that's obviously something people seldom do, especially when the targeted crowd is not limited to power users).

Password managers are not something that's been popular for decades. When a user updates a password, migration from old simple passwords should be considered as the common case. So unless it's some perfectionist users trying to hit the maximum length for every website, using the last password length regardless of which entry is being edited should provide a more intuitive and consistent user experience.

IMO #2180 should be merged after/along with the password profiles so that it can act as a default rule when a user first opens the generator. But since the ship has already sailed, an transitional solution, i.e. a setting to switch it off, would be really great to have atm.