Explain working of the app and its integration with OpenKeychain.

[RohitSurwase]

Can anyone shade some light on:

1. The internal working of Android-Password-Store app?
2. Why does it need OpenKeychain, a OpenPGP based app?
3. How does it use OpenKeychain, a OpenPGP based app?
4. How does it compare with KeePass, a secure password protected database based password managers?

There are lot of things that I can not understand from Android-Password-Store features but answers to above questions will give me/anyone a kick-start. I have read about PGP in general but can not relate it with Android-Password-Store.

[msfjarvis]

1. Detailing the internal workings is a bit too much work so if you have specific questions instead, I'd be happy to answer them.

2. We need OpenKeychain because, as you seem to be aware of, it is an OpenPGP provider. APS is a client for pass, which uses GnuPG to encrypt files.

3. OpenKeychain provides an external API for interfacing with it securely, and we wrote our own implementation of it as openpgp-ktx to act as the glue between APS and OpenKeychain

4. I'm not sure what aspect you want me to draw a comparison on so I'd appreciate some clarification before I can answer.

[RohitSurwase]

Thanks @msfjarvis.
So the reason for asking this questions is I could not understand working of APS. Like in case of KeePass, I understood, it uses the password protected database internally and master password is the only password we need to remember.

I did setup APS and OpenKeychain but I never entered any password. So how does APS and OpenKeychain work with each other? Also, it seems like there is no way to customize (easy to remember) private key, right? What happens to the saved credentials if I uninstall APS? I can see APS has some git operations, is it to use private git repo as a backend for APS?

My guess of how APS and OpenKeychain works with each other is: APS encrypts credentials using public key from OpenKeychain and later uses private key to decrypt it, correct? Then why OpenKeychain/OpenPGP, why not just use master password?

[msfjarvis]

Understanding APS' encryption model is pretty hard if you are not already a user of the pass CLI. APS simply attempts to model what the pass CLI does: Use a single directory to store passwords (optionally in a Git repo), and shell out to GnuPG for encryption.

I personally do not recommend APS to anybody who does not already use the pass CLI on their computers, simply because dealing with the mess that is GnuPG and public key cryptography is much more work than just remembering a master password that unlocks the world.

Once you add a key to OpenKeychain and clone an existing repository to APS you will not be prompted for authenticating your GPG key until you attempt to decrypt a password inside APS, which is when OpenKeychain prompts you to enter a password or connect your Yubikey.

Again, the reason we do not "just use a master password" is because we're not creating yet another password manager. APS is a client for pass, so we do what makes us compatible with it. In this case, it is public key cryptography supplied by OpenKeychain.

[RohitSurwase]

Ok, now I got some understanding. As long as I will have a control over my credentials, I am ready to learn, irrespective of complexities. If I can use private git repo as a backend, I feel APS is the perfect solution. On top of that, it has CLI support so its accessible from computers. (I could see pass is not that great at Firefox extension.) Yeah, I got to know about pass later than APS.

Could you tell me how APS stores credentials locally? I could not setup APS to use SD card as it gave me error so could not see the output. Does it save to a single encrypted database or multiple encrypted files?
Marking this thread as answer.

[msfjarvis]

We recommend letting APS store the passwords in its own private data directory, because that makes it safe from being accessed by other apps and allows us to keep control of the Git state. We maintain individual passwords as separate encrypted files, just like how the pass CLI does.

[RohitSurwase]

Thanks for answering.