Skip to content

Add per-use unlock for saved SSH passwords #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
R055LE merged 2 commits into from
Sep 27, 2026
Merged

Add per-use unlock for saved SSH passwords #60

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
765225c
Add per-use unlock for saved SSH passwords
R055LE Sep 26, 2026
a845fb5
Authorize saved password cipher before adding context
R055LE Sep 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions PROJECT_SPEC.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -777,13 +777,19 @@ If password persistence is added:

- Encrypt it using Android Keystore-backed authenticated encryption.
- Require an explicit “save password” choice.
- Support optional biometric/device-credential gating.
- Require strong-biometric or device-credential approval for every new connection that uses it.
- Keep unsupported devices session-only and provide manual entry after cancellation, key invalidation,
missing device lock, or device transfer.
- Never expose the password through general app state or logs.

Implementation decision (2026-07-31): passwords and passphrases remain
session-only. Device-credential and biometric gating are deferred optional
hardening decisions, not Phase 4 exit blockers. Biometrics require a concrete
threat-model justification before reconsideration; see `docs/BACKLOG.md`.
Implementation decision (2026-09-26, issue #46): saving a password is an
explicit option on a reusable SSH identity. Android 11 or newer and a secure
device lock are required. Each identity uses a separate authentication-bound
Keystore key, and each save, replacement, or connection use requires device
approval. Passwords remain session-only on unsupported devices. Imported-key
passphrases and replies to privilege prompts remain session-only. Cancellation,
key invalidation, missing keys, and device transfer return to manual entry or
replacement; they never bypass device approval.

### 12.3 Known hosts

Expand Down
Loading
Loading