Auto-connect request: password-manager-service for "thisnote"

store-requests privileged-interfaces
1
  • name: thisnote
  • description: This Note is an offline, privacy-focused note-taking app. Every note is encrypted at rest on the user’s device with AES-256; there is no account, no cloud, and no network access (the snap declares no network plug). It offers nested folders, tags, a built-in calendar, and a visual mind-map canvas. For some credibility you can check out my other publishings here - https://bolwarratechnologies.com. This app is already on flathub/windows/android.
  • snapcraft: This Note (thisnote) — snapcraft.yaml for Snap Store privileged-interface review · GitHub
  • upstream: PRIVATE
  • upstream-relation: I am the publisher and sole developer of the application (Bolwarra Technologies).
  • interfaces:
    • password-manager-service:

      • request-type: auto-connection

      • reasoning: On startup the app must read — or, on first run, create and store — its AES-256 master key in the user’s keyring via libsecret / org.freedesktop.secrets (Flutter’s flutter_secure_storage). This happens before anything else, because the master key is required to open the encrypted SQLite database. Without this interface the keyring call fails, the database is never created, and the app renders only a blank window — it cannot launch at all, not merely lose a feature. I verified this directly on a strictly-confined install: with the interface connected the app runs normally and notes persist encrypted across restarts; with it disconnected the app never gets past a blank window. Storing the key in the keyring, rather than in a plaintext file beside the encrypted database, is what preserves encryption-at-rest against disk theft, so this interface is security-critical rather than a convenience. The snap accesses the keyring only for its own single master-key entry and does not read or manage other applications’ secrets.

2

This request has been added to the queue for review by the @reviewers team.

3

Thanks for the detailed request and for verifying the behavior under strict confinement. Unfortunately I am -1 on auto-connection here, for the standard reason that applies to this interface: password-manager-service exposes the entire freedesktop secret service, not individual entries. When connected, your snap can read all secrets stored in the user’s keyring and your master key in turn becomes readable by any other application with keyring access. There is no way to scope the interface to a single entry, so “the app only touches its own key” is an app-behavior promise the interface cannot enforce. Because this is rarely obvious to users, we consistently decline auto-connection for this interface even where keyring use is central to the app (see the authenticator 2FA snap request, which was denied on the same grounds).

The recommended pattern is to check connectivity at startup (snapctl is-connected password-manager-service) and if not connected, show a dialog explaining what the access entails and how to connect it (snap connect thisnote:password-manager-service).

4

Fair enough. Thanks for the review!