Right now, auto-lock only works when a database is hidden. That's not really what we want for a password manager. Instead, here's what should happen:
- After a set amount of total idle time, on the order of 30-60 seconds, a curtain comes down, obscuring the page. This is dismissed by clicking on the curtain.
- After another set amount of toptal idle time, on the order of 5 to 10 minutes, the database automatically locked. This is dimissed by entering the master password.
The curtain offers privacy, not security: its job is to keep shoulder surfers from snooping around while you're transferring data from your password manager window to other applications and profiling you based on your entries.
The auto-lock offers security: its job is to ensure that a forgotten/abandoned/unused database window can't be interacted with if you leave your station and your screensaver doesn't lock people out.
Both the auto-lock and curtain timers measure total idle time. If the auto-lock timer is less than the curtain timer, the curtain feature is not used. Neither the curtain nor the auto-lock timer can be set to pathologically low values: curtain can't be any faster than say 15 seconds, and auto-lock can't be any faster than say 30 seconds. Both curtain and auto-lock timers can be set to reasonably high values, like 5 minutes. Neither can be disabled.
Right now, auto-lock only works when a database is hidden. That's not really what we want for a password manager. Instead, here's what should happen:
The curtain offers privacy, not security: its job is to keep shoulder surfers from snooping around while you're transferring data from your password manager window to other applications and profiling you based on your entries.
The auto-lock offers security: its job is to ensure that a forgotten/abandoned/unused database window can't be interacted with if you leave your station and your screensaver doesn't lock people out.
Both the auto-lock and curtain timers measure total idle time. If the auto-lock timer is less than the curtain timer, the curtain feature is not used. Neither the curtain nor the auto-lock timer can be set to pathologically low values: curtain can't be any faster than say 15 seconds, and auto-lock can't be any faster than say 30 seconds. Both curtain and auto-lock timers can be set to reasonably high values, like 5 minutes. Neither can be disabled.