Implement password sync

jsecretan commented 3 years ago

Problem Description

The iOS browser should sync passwords with Desktop and Android instances of Brave which have the sync feature enabled

Feature Overview

Please refer to the comments for details

Design

We will be using the Design created for https://github.com/brave/brave-ios/pull/4124

Implementation Details

Please refer upcoming iOS PR for details and Test Plan

User Experience

Use Desktop or Android version of Brave and save password for a few sites
Enable sync
Join the sync group from iOS

Additional information

There should be toggles for password on sync screen (on iOS) so user can choose to sync or not sync passwords.

tsndr commented 3 years ago

Will this be implemented any time soon? It's super annoying to not have my passwords on iOS.

bsclifton commented 3 years ago

Hi there @tsndr 😄

Quick update on sync overall; @soner-yuksel is just wrapping up History sync right now with https://github.com/brave/brave-ios/pull/3703

The other types we'll be looking at are:

Password (this issue)
Preferences (no issue created yet)
Autofill (no ticket created yet; app doesn't really have auto-filling yet as a feature; would need to add and implement)
Tab sync (app will need some refactoring before we can do this; it's a large scope feature)

Password would be the easiest to grab next. @anthonypkeane can help collect requirements

tsndr commented 3 years ago

Hi @bsclifton,

I appreciate the reply and am looking forward to its implementation and to using Brave again.

Apraptor commented 3 years ago

Hello @bsclifton. Seeing if there’s an update to this. Password sync is one of the last features preventing my switch from chrome. Thanks a bunch!

lil5 commented 3 years ago

@jsecretan filling in the issue template is such a small amount of effort and helps show that you actually care about your issue.

tsndr commented 3 years ago

@lil5 Are we making this about formalities now? If you don't care about this issue, just keep it to yourself.

thebrightestday commented 3 years ago

This is a critical feature. People are moving away from your product because of this. It is extremely frustrating not being able to login to any website on iphone/ipad. Basically Brave is unusable on mobile because of this.

bsclifton commented 3 years ago

Hi folks - I updated the original post; thanks for calling that out @lil5. It's good to have clear requirements for what the feature will do.

We are looking at this now - development hasn't started yet. @soner-yuksel has been digging in on the iOS side and @jamesmudgett will help with the design itself. @anthonypkeane has been leading the overall effort as the implementation may allow Brave to be used as a password manager in other applications. I assigned folks to reflect the real status (that it's being worked on)

michaldepa commented 3 years ago

@bsclifton, could you provide a timeline for this feature being released? I echo the sentiment of the others, in that this is a critical feature that significantly detracts from your product. If there is no timeline assigned for this internally at Brave yet, I will unfortunately have to switch to another browser that is more feature complete.

bsclifton commented 3 years ago

@soner-yuksel will be able to give an update here 😄 Good progress has been made actually (maybe we can share screenshots?)

soner-yuksel commented 3 years ago

Hi folks.   As you might know, we added Sync Profile Types and ability to enable/disable different sync types with our recent History Sync released in 1.30. We also plan to add password as a new sync type, but before we do that we have to revamp some of the existing features, introduce new UI changes and deal with new data format as well as migration from brave-core. Hence, we decided to approach the implementation of the feature in following steps:

Right now, in our existing design we only have “Save Logins” toggle in our Settings and there is no way of seeing saved passwords. As the first step we want to introduce new Passwords & Logins screen. In addition, we want to refine our script that enables us to save and auto-fill login information.   This week I will provide the details on the UI design change and develop login script that will link the tickets for specific details in the thread.

In short, the password screen will support listing, deleting, updating, searching and actions for the fields (open & fill, copy, reveal). For the improvements in the login script we made changes towards supporting login suggestions where window can be iframe.contentWindow and injecting into iFrame, in addition we worked on XSS (Cross-Site-Scripting) problem where it won’t inject autofill credentials.

  Some example screenshot from the potential UI changes.

1 1

We are very close to finish these first steps this week and create a PR for it.  

In our next ongoing step, we will be working on Password API on brave-core side where we can do our password operations using brave-core which enables us syncing password items. This work is already started and we finished a significant portion. In addition to creating the Password API, this work will also include migration of the existing login-password items and syncing them. When we achieved this there will be possible new alterations to UI where user can save and auto-fill the passwords in different ways.  

Finally, we would like to finish this feature by implementing a Password Manager for iOS. This will enable the user to conveniently register Brave as a password manager and use it throughout the system.

michaldepa commented 3 years ago

Thank you @soner-yuksel, I appreciate the thorough response! Do you have any target release date for this feature in the iOS app?

soner-yuksel commented 3 years ago

We dont have any hard set datefor the entire release but we are working towards landing it as soon as possible. Also, like I mentioned above, this feature will land in phases. We will keep the issue up to date and link the tickets created related with this issue here. You can expect first step with script improvements and password screen in upcoming releases.

bsclifton commented 3 years ago

@michaldepa as a safe ballpark (a date that we'll have password sync 100% completely done by) - I'd say we should have this within 2-3 months. Likely sooner 😄 As @soner-yuksel mentioned, we'll land this in phases. For example, adding the new password list screen, fixing/improving the save password prompt, and then finally wiring up the passwords from sync itself to our passwords 😄

michaldepa commented 3 years ago

That sounds great, thanks!

Apraptor commented 3 years ago

Thanks for the update! Once the passwords are synced, do you know if we will be able to use the sync passwords in other apps with the iOS auto-fill password feature, like Chrome does?

bsclifton commented 3 years ago

@Apraptor ah - being able to use Brave as a password manager. We are looking at this! I believe the work to enable this will be separate as it involves getting an entitlement and making specific changes to the app. But we definitely want to do this. Maybe @anthonypkeane can share more details

ghost commented 3 years ago

good morning everyone.

Just checking in... are there any updates on this issue so far ? Is it the only blocker between me and using brave full time.

iccub commented 3 years ago

We will most likely have to delay it a bit, to fix other retention focused things and browser parity items.

@soner-yuksel works on it and should have more insight on how much work is still needed in order to deliver it.

thebrightestday commented 3 years ago

Thanks for the update.

Unfortunately, it seems that the Brave product management team is not realizing how crucial this "simple" functionality is. As I mentioned already, nowadays the average number of devices the user has is not 2 or 3, but 10, that is a fact. Google it. So imagine how frustrating is to have a browser that does not remember your passwords throughout those devices. And we all log in multiple times a day to many websites.

There are many good things in Brave, many. But not having a basic functionality to sync my passwords, really? If you open a certain website on other 9 devices that I mentioned, how do you think the user will log in? Do you understand that this is a pitfall where the user will immediately switch to another/previous browser? Good luck retaining them at this point.

soner-yuksel commented 3 years ago

Let me give a more transparent update about progress including "what are we going to release upcoming version", "what are we working on right now" and "what are we delaying".

What are we going to release upcoming versions?

We finished the work on implementation of Implement Logins & Passwords Screen. In addition to the UI implementation we are going to release the improvements for LoginsHelper to solve iFrame and Cross-Site-Scripting problem.

Tickets: https://github.com/brave/brave-ios/issues/4112 https://github.com/brave/brave-ios/issues/4113 Pull Request: https://github.com/brave/brave-ios/pull/4124

What are we working on right now?

We are working actual password sync implementation on brave-core side, this work is mostly finished. In addition to the brave-core side work we are also working migration of existing passwords and changing the iOS code base it will support password operations thorough the new created API. This is taking a while because of the some other obstacles on brave-core side related with sync and refactoring Sync API classes and its mobile implementation.

What are we delaying?

The much needed improvements on UI while saving and auto-filling the passwords while website is on the screen. These alterations includes changes to UI where user can save and auto-fill the passwords in different ways.  

Becoming a Password Manager on iOS. This will allow us to use the passwords saved in Brave on other applications.

I hope this gave a little bit more clarification about the progress.

ghost commented 3 years ago

Thanks for the update.

Unfortunately, it seems that the Brave product management team is not realizing how crucial this "simple" functionality is. As I mentioned already, nowadays the average number of devices the user has is not 2 or 3, but 10, that is a fact. Google it. So imagine how frustrating is to have a browser that does not remember your passwords throughout those devices. And we all log in multiple times a day to many websites.

There are many good things in Brave, many. But not having a basic functionality to sync my passwords, really? If you open a certain website on other 9 devices that I mentioned, how do you think the user will log in? Do you understand that this is a pitfall where the user will immediately switch to another/previous browser? Good luck retaining them at this point.

Totally aggree on this. This basic functionality should be at core of every browser and this no-sense delay is clearly gonna cut the userbase. I am no dev by any means.. but everysingle application i have used on IOS which allowed to synch data across devices.. had this feature at day 1 release.

ghost commented 3 years ago

Thanks for the update. Unfortunately, it seems that the Brave product management team is not realizing how crucial this "simple" functionality is. As I mentioned already, nowadays the average number of devices the user has is not 2 or 3, but 10, that is a fact. Google it. So imagine how frustrating is to have a browser that does not remember your passwords throughout those devices. And we all log in multiple times a day to many websites. There are many good things in Brave, many. But not having a basic functionality to sync my passwords, really? If you open a certain website on other 9 devices that I mentioned, how do you think the user will log in? Do you understand that this is a pitfall where the user will immediately switch to another/previous browser? Good luck retaining them at this point.

Totally aggree on this. This basic functionality should be at core of every browser and this no-sense delay is clearly gonna cut the userbase. I am no dev by any means.. but everysingle application i have used on IOS which allowed to synch data across devices.. had this feature at day 1 release.

True just hope a better security than a simple key for password sync.

Apraptor commented 3 years ago

Let me give a more transparent update about progress including "what are we going to release upcoming version", "what are we working on right now" and "what are we delaying".

What are we going to release upcoming versions?

We finished the work on implementation of Implement Logins & Passwords Screen. In addition to the UI implementation we are going to release the improvements for LoginsHelper to solve iFrame and Cross-Site-Scripting problem.

Tickets: brave/brave-ios#4112 brave/brave-ios#4113 Pull Request: brave/brave-ios#4124

What are we working on right now?

We are working actual password sync implementation on brave-core side, this work is mostly finished. In addition to the brave-core side work we are also working migration of existing passwords and changing the iOS code base it will support password operations thorough the new created API. This is taking a while because of the some other obstacles on brave-core side related with sync and refactoring Sync API classes and its mobile implementation.

What are we delaying?

The much needed improvements on UI while saving and auto-filling the passwords while website is on the screen. These alterations includes changes to UI where user can save and auto-fill the passwords in different ways.  

Becoming a Password Manager on iOS. This will allow us to use the passwords saved in Brave on other applications.

I hope this gave a little bit more clarification about the progress.

@bsclifton, @soner-yuksel thank you for the update. can't wait for this feature to be released. I can't tell you how many times I'm out and about and find myself unable to access a website because the password is only stored on my desktop. Just being able to sync and access those password on my iOS will already be a huge game changer.

Samadriae commented 2 years ago

If this feature is enabled it will definitely be a game changer for this excellent browser!

tripp528 commented 2 years ago

Further confirming: this is the single feature preventing me from using Brave full time.

The lack of integration on iOS not only prevents use of Brave-iOS, but also prevents use of Brave desktop. If I save new login info on Brave desktop, my Chrome iOS will of course be out of date.

P.S. This is an amazing project and thank you to everyone involved! You are transforming the internet to a user-first environment!

NeverKnowWhat commented 2 years ago

I love Brave browser. I've been using it exclusively on Android for years, and recruiting others.

I just moved to iOS, and the inability to sync my passwords (or import) is a dealbreaker. It's forced me to use Chrome/Safari most of the time. Please, please, please prioritize this feature.

Is there any sort of timeline you can give for release? 1 month? 3 months? 6 months? If it's going to be a material amount of time, I'm going to need to adapt to using another browser long-term.

Thank you for everything the Brave dev team does! The browser is incredible! But not usable on iOS without sync/import of passwords, at least for me (and my friends switching to iOS).

WizardOfWor1969 commented 2 years ago

Yes, please put this feature in a released asap , its really a deal breaker for iOS users.

jtbrown3 commented 2 years ago

Bump 👍. Super important to not alienate iOS users. Please prioritize FULL Brave Sync for iOS!

jsecretan commented 2 years ago

Thanks everybody, this is definitely not forgotten. We are hoping that password sync finishes up some time in February, and then the team will shift focus to tabs. We'll do our best to keep everybody updated. Thanks.

mmmmyah commented 2 years ago

Bump. Looks like people have been waiting years for this feature. I want to add that I have also held off switching to brave (like others) until password sync on iOS is available. Is there a specific date in Feb 2022 that you're targeting for the release of this feature on iOS Brave? thanks

bsclifton commented 2 years ago

Hey there folks! Sorry there hasn't been an update in a while! You may have noticed we recently added the password screens into the app 😄 @soner-yuksel is working on this now and can provide an update really soon! (maybe some screenshots too)

soner-yuksel commented 2 years ago

Hi folks, sorry for my late reply. I would like give a quick update about the past, on-going and future progress related to sync and passwords.

What's released until now:

As you are all well-aware we released in 1.33 Login & Passwords Screen and LoginsHelper Improvements brave/brave-ios#4124 for local credentials. This change provides the UI functionality to save / search / update / delete and open&fill functionality.

Released-1

Please try it out and let us know if you have any feedback.

So whats coming up with next Release:

With 1.36 we are going to Release Sync-Internals. This change will allow us and users to keep track of the contains of Sync-Node and to know what is actively synchronized inside the chain. It is a very important tool that will help us figure out problems on individual cases. This screen will be reached from right bar button in Sync Settings. (Thanks @Brandon-T) brave/brave-ios#4749

SyncInternals-11 2

So... about the Password Sync:

We are planning to release the Password Sync after 1.36 ~hopefully with the 1.37. Right now we've managed to implement the core functionality which allows us to enable the password-sync and track the synced password data in Sync-Internal; and we also implemented manual add and listsync'ed passwords for different websites and credentials.

Password-sync-1

What's left to finish:

We still have to ensure/re-implement auto-fill is working with the sync'ed objects, search-query, migration of old password objects, test delete and update functions and add service listeners for updates in password objects.

eguun commented 2 years ago

Thanks. This is great news and significant progress.

Please keep in your radar that sync is broken for IOS since months: https://community.brave.com/t/ios-sync-wont-work-sync-communication-error/289995/10

Would be lovely if this updates also fixes this sync issue.

Thanks

On Fri, 28 Jan 2022 at 19:12, Soner YUKSEL @.***> wrote:

Hi folks, sorry for my late reply. I would like give a quick update about the past, on-going and future progress related to sync and passwords. What's released until now:

As you are all well-aware we released in 1.33 Login & Passwords Screen and LoginsHelper Improvements brave/brave-ios#4124 https://github.com/brave/brave-ios/pull/4124 for local credentials. This change provides the UI functionality to save / search / update / delete and open&fill functionality.

[image: Released-1] https://user-images.githubusercontent.com/6643505/151589108-efb1e6b2-cd33-4487-9531-44d224defb52.png

Please try it out and let us know if you have any feedback. So whats coming up with next Release:

--With 1.36 we are going to Release Sync-Internals. This change will allow to keep track of the contains of Sync-Node and to know what is actively synchronized inside the chain. It is a very important tool that will help us figure out problems on individual cases. This screen will be reached from right bar button in Sync Settings. (Thanks @Brandon-T https://github.com/Brandon-T) Add Sync-Internals URL support to view sync info https://github.com/brave/brave-ios/issues/4748 brave/brave-ios#4748 https://github.com/brave/brave-ios/issues/4748

[image: SyncInternals-11 2] https://user-images.githubusercontent.com/6643505/151592082-965063c5-5059-4acc-ba68-143dfb8622f7.png So... about the Password Sync:

We are targeting to release the Password Sync after 1.36 ~hopefully with the 1.37. Right now we've managed to implement the core functionality which allows us to enable the password-sync and track the synced password data in Sync-Internal; and we also implemented manual add and list sync'ed passwords for different websites and credentials.

[image: Password-sync-1] https://user-images.githubusercontent.com/6643505/151595068-22ec3f70-9cd0-47da-93de-00cbc530a739.png What's left to finish:

We still have to ensure/re-implement auto-fill is working with the sync'ed objects, search-query, migration of old password objects, test delete and update functions and add service listeners for updates in password objects.

— Reply to this email directly, view it on GitHub https://github.com/brave/brave-ios/issues/3228#issuecomment-1024484895, or unsubscribe https://github.com/notifications/unsubscribe-auth/AS3DOJ2ZI4C327LGSIG35PDUYLMCFANCNFSM4WNK4LMA . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

You are receiving this because you are subscribed to this thread.Message ID: @.***>

Apraptor commented 2 years ago

Happy march everyone. Can't wait for the password sync update.

iccub commented 2 years ago

Current status: Code is ready, we are reviewing it and performing security audit.

After all of this is done we will upload a public beta build with this feature, then if all goes well it will be delivered to the App Store build

soner-yuksel commented 2 years ago

As we mentioned in previous comment https://github.com/brave/brave-ios/issues/3228#issuecomment-1024484895

We are adding Sync Internals page with 1.36 please let us know your problems with details from internals page so we can pin point the problem. https://github.com/brave/brave-ios/issues/4560

And like @iccub mentioned, we are close to land the work for password sync and our estimation to deliver it in 1.37 is not changed.

For more details ..

brave-core PR : https://github.com/brave/brave-core/pull/12360 iOS PR: https://github.com/brave/brave-ios/pull/5013

Uni-verse commented 2 years ago

Verified using version 1.37 (22.3.29.15)

Devices: iPad (7th Gen) running iPadOS 15.2.1 iPhone 12 Pro running iOS 15.4 iPhone X running iOS 14.4.2

Test Scenarios:

Scanning QR code and enabling password sync

Passwords don’t sync until toggle is enabled.
Autofills successfully.
Able to leave sync chain and rejoin join, passwords synced successfully.
Password sync toggle not enabled by default.
Syncs both ways.

Creating Standalone chain, then joining chain

Autofills successfully.
password sync when toggle is enabled.
Password sync toggle not enabled by default.
Syncs both ways.

Upgrading with Sync Chain

Password syncs when enabled.
Adding passwords post upgrade will be added to list.
Autofills successfully.

Issues: Only enabling the password toggle one way will sync password data.

iPad	iPhone

iccub commented 2 years ago

Hey all, the password sync is out on the latest App Store build :) you may need to go to the app store to update it manually since it's a staged rollout.

Let us know whether it works for you or if there's any problems.

Next sync type in the work queue is Tabs

Apraptor commented 2 years ago

What a great day. Good bye Chrome.

jayorzee commented 2 years ago

Hey all, the password sync is out on the latest App Store build :) you may need to go to the app store to update it manually since it's a staged rollout.

Let us know whether it works for you or if there's any problems.

Next sync type in the work queue is Tabs

Hi Iccub

Thanks! It works. However, I have noticed that if I have two or more logins saved for a particular page it will auto populate one and there is no option to select the other ?

WizardOfWor1969 commented 2 years ago

Does not autofill the passwords, continues to use the "Apple system passwords" am I missing something or are you supposed to copy and paste the brave synced passwords manually to login to a site?

iccub commented 2 years ago

what website are you having problems with @WizardOfWor1969? as far as I know, our JS logic to autofill credentials does not work on every website yet

not great workaround but you can go to the password manager from the Brave settings and copy credentials to your clipboard manually

iccub commented 2 years ago

@jayorzee I think we do not handle this case yet, we plan to show a prompt before credential autofill, I will try to check if there's any design we can think of to allow handling multiple entries

Our long term goal is to reuse more of the chromium's logic when it comes to the password fill, while we implemented the sync part and you can always copy pwds manually from our password manager, our UI layer needs to improved further

0xGREG commented 2 years ago

Sites that have multi-step login doesn't work for me, for example Twitter. @iccub

WizardOfWor1969 commented 2 years ago

schwab.com does not work. Odysee.com , yewtu.be, most sites for me so far do not work. I think I could only get one to work, and I had to type in the username and the password appeared. atariage.com did work.

0xGREG commented 2 years ago

Honestly I'm just happy that I can even copy out the password. I've been waiting for this for a year.

mdlaat commented 2 years ago

I was happy with password sync for a few days, but today my ipad lost the connection with the sync chain

eguun commented 2 years ago

Unfortunalty that is a well known -and replicable- issue on IOS that is taking way too long to get acknowledged and solved.

You could voice your issue there … hopefully this will help raise awareness. https://community.brave.com/t/ios-sync-wont-work-sync-communication-error/289995

The issue has already been shared in this mailing list.

Thanks

On Tue, 12 Apr 2022 at 11:36, mdlaat @.***> wrote:

I was happy with password sync for a few days, but today my ipad lost the connection with the sync chain https://community.brave.com/t/brave-sync-on-ios-is-completely-broken-and-has-been-for-many-months-plus-other-bugs-with-sync-on-ios-too-ios-if-you-have-ios-please-read/306368/184

— Reply to this email directly, view it on GitHub https://github.com/brave/brave-ios/issues/3228#issuecomment-1096440885, or unsubscribe https://github.com/notifications/unsubscribe-auth/AS3DOJZSZCPVV6HUBPNL47TVEU72NANCNFSM4WNK4LMA . You are receiving this because you are subscribed to this thread.Message ID: @.***>

martinlanger90 commented 2 years ago

Since 1.37 my iPad does not sync anything at all. There is just a message "communication error" when trying to sync.

brave / brave-ios