PlatformException: PlatformException(Exception encountered, read, javax.crypto.BadPaddingException: error:1e000065:C...

[sentry-io]

Sentry Issue: SMOOTHIE-13Z

PlatformException: PlatformException(Exception encountered, read, javax.crypto.BadPaddingException: error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT
	at com.android.org.conscrypt.NativeCrypto.EVP_CipherFinal_ex(Native Method)
	at com.android.org.conscrypt.OpenSSLEvpCipher.doFinalInternal(OpenSSLEvpCipher.java:152)
	at com.android.org.conscrypt.OpenSSLCipher.engineDoFinal(OpenSSLCipher.java:374)
	at javax.crypto.Cipher.doFinal(Cipher.java:2056)
	at g4.b.b(StorageCipher18Implementation.java:7)
	at f4.d.m(FlutterSecureStoragePlugin.java:2)
	at f4.d.t(FlutterSecureStoragePlugin.java:2)
	at f4.d.f(FlutterSecureStoragePlugin.java:1)
	at f4.d$b.run(FlutterSecureStoragePlugin.java:25)
	at android.os.Handler.handleCallback(Handler.java:942)
	at android.os.Handler.dispatchMessage(Handler.java:99)
	at android.os.Looper.loopOnce(Looper.java:226)
	at android.os.Looper.loop(Looper.java:313)
	at android.os.HandlerThread.run(HandlerThread.java:67)
, null)
  File "data_importer.dart", line 287, in ApplicationDataImporter._getMigrationVersion
  File "data_importer.dart", line 75, in ApplicationDataImporter.requireMigration
  File "smooth_app_data_importer.dart", line 46, in SmoothAppDataImporter._checkStatus
  File "smooth_app_data_importer.dart", line 57, in SmoothAppDataImporter._startMigration
...
(5 additional frame(s) were not displayed)

[teolemon]

@monsieurtanuki @g123k we continue to have high volumes (300 a day) of this issue

[g123k]

The implementation of Flutter Secure Storage is faulty here, by not checking if the algorithm is implemented.
Nobody seems to care about a fix (the bug is opened since January 2022): mogol/flutter_secure_storage#354

[monsieurtanuki]

@g123k Maybe there's something that I'm missing, but assuming that this specific bug impacts only our data importer, I see an easy workaround.
Having a look at the data_importer.dart code, I see that we store "securely" rather harmless data like "already migrated? yes/no".
I assume we could switch those data to a less confidential storage like shared preferences or hive. Am I right?

[g123k]

@g123k Maybe there's something that I'm missing, but assuming that this specific bug impacts only our data importer, I see an easy workaround. Having a look at the data_importer.dart code, I see that we store "securely" rather harmless data like "already migrated? yes/no". I assume we could switch those data to a less confidential storage like shared preferences or hive. Am I right?

That could be a solution… and actually I simpler solution would be to totally remove this feature, now that FDroid users have already migrated

[monsieurtanuki]

That could be a solution… and actually I simpler solution would be to totally remove this feature, now that FDroid users have already migrated

I thought of that too, but I assume that if we get the bug, it's because users do use the migration tool. Or would the migration be called automatically without an explicit user action?

[g123k]

That could be a solution… and actually I simpler solution would be to totally remove this feature, now that FDroid users have already migrated

I thought of that too, but I assume that if we get the bug, it's because users do use the migration tool. Or would the migration be called automatically without an explicit user action?

The migration tool needs to check if a migration already happened in the past.
I'll check with @teolemon if it's OK to totally remove the migration process.

[g123k]

That could be a solution… and actually I simpler solution would be to totally remove this feature, now that FDroid users have already migrated

I thought of that too, but I assume that if we get the bug, it's because users do use the migration tool. Or would the migration be called automatically without an explicit user action?

The migration tool needs to check if a migration already happened in the past. I'll check with @teolemon if it's OK to totally remove the migration process.

Ping pong @teolemon

[M123-dev]

@teolemon

[g123k]

Ok, without any response, let's take this for a YES ;)

[monsieurtanuki]

Ok, without any response, let's take this for a YES ;)

@g123k Cool! What's the next move: do you remove the migration code? May I remove it?

[g123k]

Ok, without any response, let's take this for a YES ;)

@g123k Cool! What's the next move: do you remove the migration code? May I remove it?

Don't worry, I will do it.
The main part is just to ensure there is no regression