search

keepassium / KeePassium

KeePass-compatible password manager for iOS
https://keepassium.com
Other
1.17k stars 103 forks source link

MacOS/Safari: Autofill works without TouchID and TouchID-windows still appears #376

Open cryptosteve2 opened 1 month ago

cryptosteve2 commented 1 month ago

Description I am unsure whether this is a bug or a misconfiguration. When selecting the autofill entry in Safari, in some cases the credentials are already filled in and then the TouchID window still appears. Logging in works regardless of whether Touch ID is still confirmed.

How to reproduce Steps to reproduce the behavior:

  1. Go to the website
  2. Tap on Login
  3. Select the autofill entry

This happens on sites like https://www.zdf.de or https://www.abendblatt.de for example while it works as expected on github.com or https://write.tchncs.de/login

Expected behavior Confirm Touch-ID and then fill in the credentials

Screenshots On sites it does not work (here: https://www.zdf.de): 20240706@200909

while on this site is works as expected (here: https://write.tchncs.de/login): 20240706@201031

Environment:

keepassium commented 1 month ago

Thank you, @cryptosteve2 (and sorry for the delay).

I have another report about this issue, but could not reproduce it. The different behavior on different sites is a useful detail.

Can you also please share your App Protection timeout and first three options in the Data Protection settings?

cryptosteve2 commented 1 month ago

Hey, App Protection timeout is set to "Immediately", and I also activate the option to "Lock on App launch". At Data Protection I activated the option "Remember Master Keys", Database Timeout is set to "Never" and "Clear Master Keys on Timeout is activated too.

blinskey commented 1 month ago

This sounds like the same bug I described in a comment on #259. I'm seeing the same behavior that @cryptosteve2 described: autofill consistently works as expected on certain domains such as github.com but immediately fills before Touch ID authentication on other domains. My settings are the same as @cryptosteve2's.

I'd be happy to provide a list of domains where the bug does and does not occur via email if that would be helpful.

igorkulman commented 5 days ago

Hi @cryptosteve2, I am trying to reproduce your issue but no luck so far. I am using the settings you described and https://www.zdf.de where I created an account. I am on macOS 14.6.1.

Here is a video of my attempt, if I do not use TouchID or password nothing gets filled in.

https://github.com/user-attachments/assets/8b2082ea-69ab-4f2f-ab41-e752d28ea23a

Are my steps different from your steps? Can you maybe provide a video instead of just screenshots?

I am also interested in knowing if you have Quick Autofill enabled in the app and if in macOS do you have just Keepassium or also iCloud Keychain or other apps enabled in the Password Options,

cryptosteve2 commented 5 days ago

Hi @igorkulman My database is unlocked when trying to login ....

And yes, autofill is enabled. The following the options are enabled in the settings:

Quick Autofill Fill-in Perfect Result Automatically Copy OTP to Clipboard

In the MacOS settings I have only Keepassium Pro enabled, iCloud Keychain and Strongbox exists but are disabled.

igorkulman commented 5 days ago

And yes, autofill is enabled. The following the options are enabled in the settings:

Does it work differently when the database is not unlocked? Or when the Keepassium app is not even running?

Asking because I still cannot reproduce, even with Quick Autofill enabled, database unlocked and all your other settings:

https://github.com/user-attachments/assets/9e189261-5611-4d17-8b71-6c252b3e7661

cryptosteve2 commented 5 days ago

It makes no difference whether keepassium is running or not. In this video I skip fingerprint by pressing ESC ....

https://github.com/user-attachments/assets/832168a2-9f35-4a8e-8db3-a4e36b5c21ce