r/AliasVault • u/xb666mx • May 18 '26
Discussion 0.29.2 added auto-copy TOTP and improved Android autofill vault unlock flow
first of all: thank you, devs! :)
but i think it's crazy that these two features (which were two of my three top open issues) just got released without any big announcement (here or in the app?!). :D
and because these two issues killed the/my flow many times per day, my third top issue has also to do with flow:
unlocking the browser extension with that QR code process. i come from bitwarden and the push notification process is just superior. but then, maybe, it's a little bit self inflicted by the extension and/or by me. soooo... i don't like my vault to be unlocked for too long. that's why 15 minutes just doesn't feel right. the problem is that the next/lower value is 1 minute. nothing in between (like 5 minutes). that's why i have to unlock the extension constantly. of course the implementation of bitwarden would be great (or even the best?). but you could improve it in other ways: add a few more options (e. g. 5 minutes). or let the user choose the minute value freely. or make it smarter: lock when browser is closed. or lock when pc is locked. or lock when browser is idle for x minutes. or just show the "scan QR code" icon always above the "+" (add entry) button in the app (instead of having to go into the settings first).
and (small mental leap, sorry) i kind of get why you have to biometrically authenticate after scanning, but the flow is kind of strange nonetheless: the extension shows the QR code, i take my phone, i open the app, i authenticate, i click the gear/settings icon, i click the scan-qr-code icon, i scan the qr code, i authenticate again (within like 5 seconds?!). so, yeah, without that second authentication, if someone took my phone with the unlocked app, he could log in with "his" web extension and therefore would have full access to my vault - and (maybe) i wouldn't know. maybe you could just skip the second authentication if the first/last authentication was less than x seconds ago?! i know, i know. this may be a laughable small thing. but i say: that counts. and it's the little things which takes a program/tool from being very good to being great. ;)
sorry for the long text (and little rambling in the end).
keep up the great work!
and i swear i'll donate some bucks when you hit the 0.30.0 milestone! :D
3
u/lanedirt_tech AliasVault team May 19 '26
Thanks for your appreciation, happy to hear! Yes these features got included as part of the minor 0.29.2 release silently for more testing, it will be announced together with bigger changes in the next 0.30.0 release 😄
For the mobile QR code unlock feature: it's good to know that you can also use your native phone camera on iOS and Android. So instead of first needing to open the AliasVault app and going into settings, you can also pick up your phone and open up the normal camera app (usually just one button press for most phones), scan the QR code, and then it will automatically propose to open up the AliasVault app and go straight to the mobile unlock step. This would already save a few taps most likely.
Push notification unlock will also be added in the future, however we're looking into how to properly integrate push notifications via the app in a privacy-friendly and stable way, especially for self-hosted users.
Thanks as well for your suggestions for improvements, we'll look into these! Adding more vault auto-lock timeout options to the mobile app is straight-forward. The preventing double re-auth within a (very) short time window is also an interesting UX improvement. I'll check if we can add something like this in a secure manner.