search

browserpass / browserpass-extension

Browserpass web extension
ISC License
852 stars 53 forks source link

Report websites where Browserpass doesn't work #62

Open maximbaz opened 5 years ago

maximbaz commented 5 years ago

Please use this thread to report websites where Browserpass doesn't fully work, e.g. Browserpass is unable to fill username or password, or fills wrong form, or autosubmit doesn't work.

I'm not promising to support every single website, but I will investigate every example and if possible improve the detection logic.

I will not however add special cases for certain websites, I don't want Browserpass become a collection of broken websites on the Internet 🙂

RalfJung commented 4 years ago

On https://www.doncamillo-saarbruecken.de/, filling in the password only works after I clicked into the password field once to clear its contents.

maximbaz commented 4 years ago

Thanks as usual 🙂

https://www.itead.cc/ https://www.ozon.ru/

These two show similar behavior but I currently have no good ideas how they could be solved without breaking a lot of other websites, their markup violates our core assumption that if website developers know what a <form> tag is, they would at least use it for login form - so we have some fallback logic that just takes any available form, and on these websites it turns out to be the search form... Unless I come up with something clever, they will have to be supported by https://github.com/browserpass/browserpass-extension/issues/195

https://www.doncamillo-saarbruecken.de/

This one is so silly we can't support it, they change the field type on click via javascript, so until a user clicks on the field it is truly a non-interesting regular text field where passwords most certainly should not be inserted... 😄

532910 commented 4 years ago

https://bill.nevalink.net login and password are filled, but not submitted

532910 commented 4 years ago

https://zadarma.com/en/ Error: Error: No fillable forms available for fields: login, secret

532910 commented 4 years ago

https://www.voip-info.org login and password are filled, but not submitted

equaeghe commented 4 years ago

https://orcid.org/signin

Password is filled, but username is not.

532910 commented 3 years ago

RouterOS router webfig login page login and password are filled, but not submitted

It could be tested online: http://demo.mt.lv/webfig/

erayd commented 3 years ago

Thanks @532910. Will investigate why this is, as fill + enter does work, so it seems odd that autosubmit doesn't.

As it happens, I use Browserpass to log in to RouterOS on a daily basis, and @maximbaz also has a router that runs it. So we don't need the online demo to test with. But I do appreciate that you linked it for us - thank you!

erayd commented 3 years ago

@532910 I've investigated, and it seems the RouterOS webfig login page doesn't actually contain a form at all. The fields are simply input fields in a table, and the login button isn't actually a button at all, but merely a styled link with a javascript click handler attached to it.

There's no way that Browserpass should ever be auto-submitting something like that sorry. However, autofill + pressing enter does work just fine.

532910 commented 3 years ago

Thank you for investigation

DamienCassou commented 3 years ago

It seems that browserpass can't find the submit button in https://app.nalo.fr/components/auth/#/login.

morciej commented 3 years ago

This is using Ver. 3.7.2 in Firefox 87.0

Filling a modal html form doesn't work for local addresses like 192.168.X.XXX. I make sure to name containing folder to 192.168.X.XXX.

It is easy to be deceived by the browser filling out the credentials from history. In order to reproduce, make sure to delete history for the server.

morciej commented 3 years ago

Again, Ver. 3.7.2 in Firefox 87.0 On https://www.fido.ca/profile/signin, as well as https://www.airbnb.ca, browserpass fails to find any fillable elements. But when the site is displayed with no style, it finds them, and once reverted to basic page style, it keeps finding them (in the same session only).

First time only, I get a complaint window, saying "javascript application, form origin is supposed to be www.fido.ca (or www.airbnb.ca) but it is www.google.com. Then I say OK, and I get the ebove error.

DamienCassou commented 3 years ago

Doesn't work on: https://espacepro.cmb.fr/auth/login

maximbaz commented 3 years ago

Thank you for posting these 👍

The case here is that markup is weird, the fields which Browserpass doesn't find are simply not passing sanity check. In the first case it's unidentifiable login button (we avoid pressing a random button after putting credentials on the page), in the latter two cases it's just bad markup, login fields are actually made invisible with CSS and what you see on the page is divs drawn to look as fields... So browserpass doesn't treat those invisible fields as a real login form.

My best suggestion is to get those supported via https://github.com/browserpass/browserpass-extension/issues/195

Filling a modal html form doesn't work for local addresses like 192.168.X.XXX

This I could not actually reproduce, or I misunderstood the issue. If I go to an IP address and it contains a html login form, and I have in my password store an entry called <ip-addr>.gpg, it will be discovered by Browserpass, and I would see it in popup.

If it's a modal HTTP form (a popup that browser shows, which prevents you from interacting with browser until you submit or cancel this popup), make sure to look at this section of the docs, for example you must open such page from within Browserpass for it to be able to provide the credentials.

Doesn't work on: https://espacepro.cmb.fr/auth/login

At the moment the root cause is https://github.com/browserpass/browserpass-extension/issues/73, didn't research if their markup is good otherwise.

jbalme commented 3 years ago

https://my.wealthsimple.com/app/login?locale=en-ca

paulperegud commented 3 years ago

https://www.centrum24.pl/

EDIT: this is definitely a case for https://github.com/browserpass/browserpass-extension/issues/74, custom selectors specified in pass entries.

meskes commented 3 years ago

Trip Actions seems to do some non-standard stuff, at least I cannot get browserpass to fill in my details: https://app.tripactions.com/app/user2/auth

aventrax commented 2 years ago

@tomclark Home Assistant is really annoying for me.

Any update? Home assistant has no "name" property in the input fields so I tried to add them but nothing changed. Where is the issue?

532910 commented 2 years ago

ikea.com login and password are filled, but not submitted

a20caa6e-0bcb-11ec-b174-db94a7bb8a28 commented 2 years ago

On https://demo.jorani.org/session/login only the username is completed, but not the password.

disketten commented 2 years ago

On https://www.jollyroom.dk/mine-sider/log-ind only "password" is completed, not "username". The "username" field is called "email" in the html.

532910 commented 1 year ago

browserpass successfully fills username and password for openwrt's luci but doesn't automatically submit form after this

ralozkolya commented 1 year ago

On https://ibank.bog.ge/ It throws this error:

Error: Error: No fillable forms available for fields: login, secret

532910 commented 1 year ago

I can give my Home Assistant public address of for @maximbaz or @erayd for investigation, but would not like to publish it here.

Hate9 commented 1 year ago

Sites using Authentik (https://goauthentik.io/) don't work.

fuu0 commented 1 year ago

GLS Onlinebanking is broken: https://www.gls-online-filiale.de/services_cloud/portal only "password" is completed, not "username" - html Field for username is html element "vrNetKey"

Is there a way to add a Element to USERNAME_FIELDS in a variable per pass entry? so i can add user: and userfield: vrNetKey in my passstore...

timonegk commented 11 months ago

Field for username is html element "vrNetKey"

"vrNetKey" is also used by other German banks, e.g. Volksbank and Sparda-Bank: https://www.sparda-h.de/services_cloud/portal/login https://www.sparda-bank-hamburg.de/services_cloud/portal/portal-oauth/login https://www.hamburger-volksbank.de/services_cloud/portal https://www.volksbank-eg.de/services_cloud/portal/ https://www.berliner-volksbank.de/services_cloud/portal/

erayd commented 11 months ago

Instagram (see #323)

BastienDurel commented 7 months ago

On https://www.borgbase.com/login

Error: Error: No fillable forms available for fields: login, secret

foxyseta commented 2 weeks ago

On https://www.interrail.eu/en/login#/login, the username field (email) is filled in properly, but the password is ignored. I could not see any output from the extension on the developer console. Am I supposed to be looking somewhere else?