open-keychain

open-keychain copied to clipboard

We had reviews on G Play and comments from people that could not find how to paste keys from clipboard. We should improve this situation somehow.

I can't find it either... Is this feature available?

Edit: I found it now.

Selecting 'read from file' to read from clipboard is not very intuitive indeed!

It's worth mentioning that the clipboard on android is very insecure: Any app can monitor and manipulate the clipboard at will, requiring no permissions. A malicious app could switch out a public key you copy into the clipboard for an on-the-fly generated one with the same user id and creation date.

That's the reason we are hesitant encouraging use of the clipboard as a means of transferring keys. That said, if the user copies a key to the clipboard we shouldn't make it hard for them to import.

Ideas that come to mind, things we could do independently:

• if there is a key in the clipboard when the import activity is opened, show a button to list them instead of the empty list
• create a service for monitoring the clipboard, offering import in a notification
• add import as text action

The "Read from clipboard" functionality works only when importing public keys, but this is not clear when trying to import private keys. This implies that an user might copy their private key to the (insecure) android clipboard and then receive a generic "Could not read keys from clipboard!" error message (e.g., #2306).

I think that the limitation of importing only public keys (as well as the issues in importing any key) from clipboard should be made clear.

The "Read from clipboard" functionality works only when importing public keys, but this is not clear when trying to import private keys.

The issue was opened a way long ago, could we improve the situation even by just changing a text in the UI?

There's no reason (that I'm aware of) that users shouldn't be able to import a private key stub from the clipboard to enroll a hardware token.