keepassxc icon indicating copy to clipboard operation
keepassxc copied to clipboard

KeePassXC should explain why "Input Monitoring" is being requested on launch (v2.7.7)

Open snrkl opened this issue 11 months ago • 9 comments

Summary

After upgrading to KeePassXC 2.7.7 I was presented with a dialogue where KeePassXC was requesting access to monitor all keyboard inputs.

Screenshot 2024-03-19 at 12 48 39 pm

A little sleuthing (https://github.com/keepassxreboot/keepassxc/issues/4613) leads me to believe that this is connected to the new features in 2.7.7. that provide auto-detection of Yubikey etc. (this only occurs for me when there is a yubikey plugged in)

It would be good if this was explained at launch time, so that the user can:

  1. Understand why this access is being requested; and
  2. Make an informed decision to allow this or not.

For example, as this instance I am running does not use my yubikey (or equivalent device), I have not provided it with "Monitor Inputs" privileges.

Examples

[ INFO ] [ In order for KeePassXC to use ] [ your Yubikey, we need you to ] [ Grant the "Monitor Inputs" OSX ] [ system permission. We need ] [ because {reasons}. If you don't ] [ give permission, then {results} ] [ will happen... ] [ {GRANT} {DENY} ]

Context

I feel that apps that seemingly ask for permissions out of the blue with no explanation or justification is just teaching users to blindly undo years of security defence in depth work done at the Operating System level.

I believe that security focused applications like password vaults should be the best behaved citizens of the security privilege world, so that we aren't re-enforcing bad patterns of user behaviour that can be abused by malicious actors.

snrkl avatar Mar 19 '24 02:03 snrkl