Disable password hint isn't working for me

[ShlomiD83]

Hi guys,
I'm trying to disable the password hint feature but the feature won't disable.
My config.json shows the option as disabled
password_hints_allowed": false, "show_password_hint": false,

If I check the admin portal I see the option as disabled as well but when I press the Get master password hint it sends the hint email.

How to disable it completely?

[BlackDex]

I'm guessing that you think it isn't working because you still see the options on the web-vault interface etc...
That is because we currently do not support dynamic CSS changes (yet) which could hide those elements from view.

But rest assured, the feature will not work and produces error's or empty responses where needed.

[ShlomiD83]

Are you sure? Because I'm getting an email with my password hint.....

[BlackDex]

A wrong if check was done. I fixed that just now and a PR is awaiting for merge now.

[ShlomiD83]

Now it throws an error, thanks.

[jjlin]

I don't think this change is correct actually. If you read what these settings are documented to do:

• show_password_hint -- "Controls whether a password hint should be shown directly in the web page if SMTP service is not configured."
• password_hints_allowed -- "Controls whether users can set password hints."

This means that password_hints_allowed will prevent a user from setting a new password hint, but if a password hint was already set prior to password_hints_allowed being disabled, it will still be returned to the user. From a user-centric view, you could argue that it would be inappropriate to unilaterally remove their access to a hint they may have been depending on. From an admin-centric view, you could argue that the admin doesn't care how a user feels about this.

[stefan0xC]

I concur that the change is not correct because the description specifies that it would only affect systems where SMTP is not configured:

vaultwarden/src/config.rs

Lines 502 to 505 in e927b8a

	/// Show password hint |> Controls whether a password hint should be shown directly in the web page
	/// if SMTP service is not configured. Not recommended for publicly-accessible instances as this
	/// provides unauthenticated access to potentially sensitive data.
	show_password_hint: bool, true, def, false;

At the moment the change in #5180

vaultwarden/src/api/core/accounts.rs

Line 845 in e927b8a

if !CONFIG.mail_enabled() || !CONFIG.show_password_hint() {

disables the password hint for anyone that has not enabled mails and turned it into a switch for when you have mail enabled.

I think we have a few options:

1. show_password_hint should determine this for both options (so whether you have mail enabled or not would not matter) in which case we should update the description accordingly,
2. we return to the previous state, where mail enabled systems would sent already configured password hints to users (even if admin later decides to forbid setting password hints)
3. or we change it back and let password_hints_allowed decide instead whether password hints will be sent even if it's already configured instead of show_password_hint).

My preference would probably be the third option (if I don't allow password hints I don't want this to work), because the first seems a bit silly as we do have another option for that, and the show_password_hint option would only be relevant for systems that don't have mail enabled (which you have to activate).