USB Hotplug Detection and TouchID lid close fix

[phoerious]

KeePassXC now automatically detects hotplugged USB devices, so users don't have to manually refresh the YubiKey list anymore.

Also fixes TouchID not being available after lid close (fixes #8945 and #10315)

Type of change

• ✅ New feature (change that adds functionality)
• ✅ Bug fix

[droidmonkey]

This is great, we can also implement an option to auto lock the database when the yubikey is unplugged. The downside to that is if you have pending changes to save, you'll have to plug your key back in.

[phoerious]

Windows implementation added. This should be ready for review.

[codecov]

Codecov Report

Attention: Patch coverage is 53.75375% with 154 lines in your changes are missing coverage. Please review.

Project coverage is 63.94%. Comparing base (79ca006) to head (42a9c3a).

Files	Patch %	Lines
src/keys/drivers/YubiKeyInterfacePCSC.cpp	1.67%	59 Missing ⚠️
src/gui/DatabaseOpenWidget.cpp	61.79%	47 Missing ⚠️
src/keys/drivers/YubiKey.cpp	44.00%	14 Missing ⚠️
src/gui/osutils/nixutils/DeviceListenerLibUsb.cpp	79.69%	13 Missing ⚠️
src/keys/drivers/YubiKeyInterfaceUSB.cpp	16.67%	10 Missing ⚠️
src/gui/osutils/DeviceListener.cpp	70.00%	6 Missing ⚠️
src/gui/databasekey/YubiKeyEditWidget.cpp	83.33%	4 Missing ⚠️
src/core/Translator.cpp	50.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #10092      +/-   ##
===========================================
+ Coverage    63.80%   63.94%   +0.14%     
===========================================
  Files          355      358       +3     
  Lines        43298    43375      +77     
===========================================
+ Hits         27625    27736     +111     
+ Misses       15673    15639      -34     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[phoerious]

I took the chance to also improve the unlock widget.

All clutter except the password field is now hidden away by default. The hardware key selection has been reduced to a single checkbox that is only shown when a key is inserted and the key file selection is just a small link:

I show a hardware key selection combobox only if more than one key is inserted (when does that ever happen?):

Clicking the key file link opens the key file selection and then adds a new UI element for it:

[liayn]

I show a hardware key selection combobox only if more than one key is inserted (when does that ever happen?):

That happens all the time if you have any account that allows to register only 1 OTP key (Paypal... to name a few), but one owns multiple keys (which you should).

[phoerious]

You should have multiple keys for backup purposes, but there is no point in having them plugged in at the same time, unless perhaps you have one for work and another personal key. If you are just too paranoid to use the same key for different services, then you also shouldn't have them with you at the same time.

But anyway. You can have two plugged in if you need to.

[synthgab]

when does that ever happen?

When you have a Yubikey with two slots (e.g. a Neo) ...

By the way, I struggled a little bit with this new feature and it seems that the key is not detected correctly right upon insertion: my 2015 Yubikey Neo still works like a charm, but its getting old and now needs some time to wake up, so I'm not sure this is worth filing a bug report.

The trick is to check the serial number: a 'refresh' is needed when it's only 2 or 3 digits instead of the 7 digits I expect, not a big deal, just paying attention when unlocking the database...

[phoerious]

Which YubiKey do you have?

[synthgab]

Hello, I have a Yubikey NEO, I bought it in something like 2015. Firmware version is 3.4.9, if that may help, but as I said, I'm used to have to wait a few seconds for it to initialize when plugged-in (TOTP over NFC on Android also takes a few seconds to load the codes).

I have kept slot 1 for Yubico OTP (with a custom keypair used for VPN connection), and slot 2 with challenge-response for KeepassXC, on top of the TOTP feature for several other accounts.

[Edit] Syntax fixing.

[droidmonkey]

The NEO keys were garbage, they have to be handled specially because they don't comply with yubikeys spec.

[phoerious]

I have a spare NEO as well and tested it with the change. For me, it worked totally fine. What OS are you on?

[synthgab]

Hello,

Thank you for following up on my comment, I'm on Windows and I reproduce this delay on both Windows 11 (23H2) and Windows 10 (21H2).

However, I agree with Neo 'randomness': each manufacturing year behaves differently, and this is why I don't believe it's worth spending time on this. I managed to adapt to my NEO specialties , my friends who are using some did the same, and when the replacement time will come, I'll perform a more thorough review...

Thanks !

[cdo256]

This is a great feature for convenience, however it's not automatically detecting new keys. On Linux (Guix), on the unlock screen, I'm only seeing new hardware keys I insert after I exit to the main page and go back to the unlock screen. On the terminal I'm getting:

Hardware key USB error: Access denied (insufficient permissions)

I performed an strace, but I couldn't determine which access it was. Nothing related to udev, dev, sys, pam, or usb stood out as being the culpret. As expected running keepassxc as root, resolves the issue. I've attached both straces for running under sudo -E and straight as a user.

The operating system is Guix Linux at a8353e9d6b34fd8d42d2e8f14ce844849fe9c293.

Let me know if you need any more information.

sudo-strace.trace, user-strace.trace.

[droidmonkey]

You need the yubikey udev rules installed. Never heard of guix though.

https://github.com/Yubico/yubikey-personalization/blob/master/70-yubikey.rules