Verify function always return true, am I doing wrong?

[RasyiidWho]

Describe the bug
This issue happen in random device, verify function Password.check(password, hash).withBCrypt() always return true, even with wrong password.

To Reproduce
App with login (username & password) system.

Expected behavior
Verify function return correct value.

Environment:

• OS: Windows

• IDE: Android Studio 4.2 Canary 12

• Device spec with working Verify function
  

• Device spec with Verify function always return true
  

• Other
  
  

Additional context
Here's my code and result:

Code

Result

Thankyou firaja :D

[firaja]

Hi @RasyiidWho,

what happens if you do something like this?

Hash hash = Password.hash("uwu").withBCrypt();
boolean verified = Password.check("wrong password", hash.getResult()).withBCrypt();

if(verified)
{
    // Print "OK"
} 
else
{
    // Print "KO"
}

What are the configurations in your psw4j.properties file?
Do you have the same issue on a classic Java application or just on Android?
Thanks

[RasyiidWho]

what happens if you do something like this?

I have tried using this code

Hash hash = Password.hash("uwu").withBCrypt();
boolean verified = Password.check("wrong password", hash.getResult()).withBCrypt();

if(verified)
{
    // Print "OK"
} 
else
{
    // Print "KO"
}

but still gives me same result (always return true)

What are the configurations in your psw4j.properties file?

I'm on Android Studio IDE with gradle as a build tool. I've try to put psw4j.properties in classpath, but it's seems library not picking up the properties file. Trying to use gradle.properties and set jvm argument org.gradle.jvmargs=-Dpsw4j.configuration=G\:\\AndroidStudioProject\\ROUTEKNIS\\psw4j.properties but still the same (not picking up the properties file). So for now it uses default properties

Do you have the same issue on a classic Java application or just on Android?

I tried your code in NetBeans IDE, and it's working well, so it only happen on Android, even not all Android phone have this issue

[firaja]

On which Android devices is working? Do they have something in common?

[RasyiidWho]

On which Android devices is working? Do they have something in common?

I have test in on 3 phones. There are 2 physical device (android 10 & 6) and 1 emulator device (android 10). And this problem only happend in 1 physical device that have android 10.

[firaja]

I've tried the following in a build.gradle file

plugins {
    id 'java'
    id 'application'
}

applicationDefaultJvmArgs = ["-Dpsw4j.configuration=/path/to/file.properties"]

And the file is correctly read on Unix systems.

On Windows I suggest to to not escape :
You can use
G:\\AndroidStudioProject\\ROUTEKNIS\\psw4j.properties
or
G:/AndroidStudioProject/ROUTEKNIS/psw4j.properties

You should also check on your device if there's some known problem with the generation of random bytes.
You can check with the following property if the problem occurs again:

global.random.strong=true

This is always recommended if your JVM supports SecureRandom.getInstanceStrong() and it points to a non-blocking source of entropy, otherwise you may experience huge performance drops.

Also check if this method returns every time different results:

SaltGenerator.generate();