[BUG] Adding new fingerprint causes constant warning

[heinrichat]

Describe the bug

Hi,

i've been using your software lately and I'm vry happy with it. Thanks for keeping development going.

I've encountered an issue. I've recently reenrolled one of four fingerprints. Since then this warning message pops up constantly when tapping on an entry. I can dismiss the message, but next time (opening the same entry in the same app session even without closing or switching to a different app) it pops up again. Very annoying and time consuming. I can't acknowledge that "I confirm it was me who who changed the fingerprints on the device" or get the message to dissapear without deleting all fingerprintt (which i don't want to).

I've tried to disable needing fingerprint or PIN when tappong on a entry, but it still shows the warning message.

Steps to reproduce

Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior

A setting which allows me to confirm the change.

Screenshots

Device information

• Device: Google Pixel 9
• OS: GrapheneOS latest
• App version:
  version 1.16.0-SNAPSHOT

app.passwordstore.agrahn
versionCode 11600

targetSdk 36
minSdk 26

Installed: Sep 22, 2025; 22:32
Updated: Nov 30, 2025; 20:34

Additional context

No response

[agrahn]

The warning shouldn't come back after the next successful unlocking of a password item with the correct PGP passphrase. Did you try that?

[heinrichat]

That worked, thanks. Solved.

[qfjp]

If the passphrase is empty the warning keeps appearing. Given the above a workaround is to change the passphrase and unlock some password, but I still think this shouldn't be necessary.

[agrahn]

I didn't consider the case of an unprotected secret PGP, as it is generally a bad idea, rendering the whole purpose of a password safe pointless.

[qfjp]

Well, fair. Though i only use unprotected keys on encrypted drives anyway so I feel they're already protected behind another password. I suppose someone could take advantage of it if they have physical access to my device, but in that case I think I have bigger problems than just my key.

[agrahn]

Gaining unauthorized access to a mobile device ist not that unlikely to happen, e.g. by shoulder surfing.

Anyway, I'll leave this open in case someone else is facing the same problem.

[qfjp]

Point taken. I guess my use case is less common since most of the time these devices are limited to the house anyway; more like a thin client than a phone. Either way it's not a big deal as there is a workaround.