Support mSecure
JSON error in (a random number here)
I was able to restore the database on the computer using a backup emailed from the phone. But could someone please tell me why this happened? I logged into my account on the computer, everything was fine, I could see all my passwords, then mSecure did a sync, and all the JSON errors occured slowly, one at at time, as it overwrote every entry in my password database.
Then when i logged back into the phone to sync, I lost that database, too after it synced. The entries all said decryption error. So I restored taht from the same backup.
Is this now going to happen every time there is a sync?
Mike - mSecure
Hi Stuart,
Obviously, this shouldn't be happening, and if it were to happen every time for the life of the app, I'm sure you would stop using mSecure. You've run into a problem, so we'll have to solve it to get things back on track.
Before I send instructions to try to fix the problem, can you let me know how you went about changing your password on June 19, about 10 days ago? Did you perform an account reset on our website? If you did, on how many devices did you reinstall mSecure?
Also, when you restore from the backup you created, all your data looks good, right? The state you're in now, can you confirm that after you restored from your backup on your phone that you see all your data and it doesn't show any error on that one device?
Hi there, I logged in this morning to see the same thing with lots of entries that just say JSON error in (number). At first glance of my starred entries I think these are possibly new entries, and looking at them (see screenshot for an example), they appear to have french tags associated with them, so feels a bit worrying as though these entries have come from someone else's account?
Mike - mSecure
Hi Fergus,
Thank you for contacting us, and I'm sorry for the issue you are experiencing here. I have been talking this over with our developers over the past couple of days, and we've found the issue causing what happened. The problem is that in a newer version of mSecure, one of the last beta versions for Windows, records can get created without access control. The bad news is, that does lead to seeing records you shouldn't, but the good news is, first we found the issue and it will be fixed in the next release, and second, since all data is encrypted with your unique account key, other accounts will never be able to read the data stored in those records. This is why you're seeing the "JSON error in XXXXXXXXXX" for the records. Since mSecure can't read the encrypted data, because it doesn't have the correct account key, the data can't be displayed.
To sum this up, you are seeing records that were created in a different account. The issue can come about in unique circumstances and will be fixed in the next version. And last, in cases like this, if the bug were to happen again, different accounts cannot decrypt the data stored in other accounts. Records may be able to be seen, but the data will never be readable.
Hi Mike
As per Fergus's response I too am seeing 717 additional entries in the same format as reported i.e. JSON error in XXXXXXXXXX as per the image below:
All of the records seemed to have been created on 26/11/2022 and then subsequently modified at a later date and relating to French tags. I may have misunderstood when you advised in the previous post " you are seeing records that were created in a different account" but are you saying that the records came from another user's account? Do these records relate to anything that I have entered in any way? In either case are these deemed as being breaches in data as I am potentially seeing details relating to another user and they conversely could be seeing my data? Is this related to the way in which the data is synced i.e. one process being less secure than another. I hope you can understand my concerns here!
Mike - mSecure
Hi Michael,
First off, I do understand your concern. Without knowing what happened, it would be very alarming to see any form of data created in another mSecure account. However, as I mentioned in my response to @Fergus, there is no breach in security. The problem is that in a newer beta version for Windows, records can get created without access control. This simply means that records can be (not always) created as public records. However, every record created in mSecure is encrypted with the user's Account Key, and this is why there is no data breach. Yes, you can see the name of the template used for the record, and you can see the tag(s) that were applied to the record, but you can't see any sensitive information stored in the record, because it cannot be decrypted in your account. The record is simply a container stored in the mSecure Cloud database, but the contents stored in that container can never be decrypted in different accounts. The only account that can decrypt the data stored in the container is the account in which the record was created to begin with.
Three things are important here: 1) Since the record cannot be decrypted, the data originally stored in the record is not available, which is why you are seeing "JSON error XXXXXXXXXX" for all of the titles and there are no fields containing data in any of the records; 2) If you are not running beta version 6.0.317.0 or 6.0.318.0, any record you create will never be made public; 3) Even if this were a widespread bug, which it is not since only about 5 users have downloaded those versions of the Windows app, and you created records that were seen in other accounts, the data you added to the record(s) would never be able to be read in other accounts.
The issue is already fixed in the newest beta already released, so this will not be a problem as soon as the beta users have updated their mSecure apps.
Now, in order to work-around the problem, I first need to make sure I know which version of mSecure you are running. Please click the gear icon in the bottom left corner of mSecure's screen, then click About mSecure in the Settings screen. What version does it say you're running?
Hi Mike, thanks for getting back to me on the JSON error entries. I appreciate the explanation too and it's good to know these aren't corrupted entries of mine, and that the account security keys are doing their job. I share the concern @Mihael has around data security so it's also a relief that a new version is on the way.
Mike - mSecure
No problem at all @Fergus, and I'm sorry you and other customers had to experience this issue in the first place. I know it is stressful and very inconvenient. One thing to note, working around the issue is pretty simple. If you can go to the About mSecure Settings and let me know which version you are running, I will get you instructions in my next post.
Hi Mike thanks again for the explanation and putting my mind at rest. I'm running 6.0.271.0 on my laptop and 6.0.8 (896) on my iphone.
Mike - mSecure
@Mihael No problem at all! Since you are running 6.0.271.0 on your PC, if you are still seeing any of these records with the "JSON error XXXXXXXXXX" as the titles, you can simply permanently delete them. To do this, select them all, then click the trash can item in the right column. After you do that, click the "Deleted Items" option in the left column, select all the deleted records and click the trash can icon in the right column again. This will permanently delete the records, and you shouldn't see the issue again in the future.
Stuart
I have MSecure on my iphone working fine, v 6.0.6. I logged into mSecure on my Win10 computer v6.0.271, and now every password entry on the computer says "JSON error in (a random number here)". I have tried re-syncing the computer, and that does nothing. Please advise.
1 personne se pose la même question