option for 'Automatically submit forms' ('autologin' feature request)

[nestukh]

I kindly ask to have an option in the browser addon for 'Automatically submit forms' (also known as 'autologin'), so to be on par with other solutions (lastpass, Kee + keepass2 + KeePassRPC).

Expected Behavior

If credentials are set to be autofilled (with other options), they should also submit the form and therefore complete the login process automatically.

Current Behavior

With credentials set to be autofilled, the plugin just fills text fields, but it stops there. Enter/Login/Confirm has to be pushed.

Gentle note to the developers

Yesterday, the #215 issue, on almost the same subject, was rudely closed with an excuse not dissimilar to the famous "It's a feature, not a bug". Look, if other addons have this thing, it might be logical to think that users find it useful? Is this too much wit?

Possible Solution

An option for 'Automatically submit forms' in the addon settings, that either adds a simple ENTER to the end of passwords or retrieves Auto-Type preferences for the entry from the database and use them in the browser.

Debug info

KeePassXC - 2.3.3 keepassxc-browser - 1.1.7 Operating system: Debian Stretch Browser: Firefox ESR 60.0.2 (64-bit), tarball installation Proxy used: YES

[varjolintu]

This is possible to do. But I'd prefer it to be disabled by default.

Maybe the previous issue was closed because it was uncertain if you wanted to use the browser extension with Auto-Type.

[droidmonkey]

Auto submitting credentials is very dangerous. There are many situations where forms are filled incorrectly and an auto submit would result in your credentials being leaked. I closed the other issue because we do not have this enabled for security reasons. That is the main reason autofill is disabled by default as well, it is a security risk to throw your credentials into any form the plugin thinks is the login process.

Auto-Type requires the user the actively select the credential field and hit a key combo. In this case we reasonably assume the user knows what they are doing. Autofill from the browser extension can and does make mistakes with no user interaction required.

Another issue would be if you were changing your password in settings, autofill would fill the fields and hit submit over and over again.

[varjolintu]

@droidmonkey is absolutely right. I also don't recommend implementing this feature because of its insecurity and possible side effects.

[nestukh]

If credentials are already matched by url, and can be already autofilled, won't the habit of clicking "Login/OK" buttons every time / be a security risk as well, like was with windows vista? Or even connecting to the interwebs with javascript enabled? Or the acquired habit of mindlessly Auto-Type credentials? Sounds like hiding behind excuses again, to me.

Disabled by default is ok, but 'disabled by default' plus 'on-url basis if enabled' will be better, maybe proposed to the user after a successful login has been perfomed. For clarity, we have these hypotheses: 1 there is only one set of credentials for a given website, 2 autofill has been enabled by the user in the settings, 3 such 'on-url basis autologin question' (eg: 'would you like to enable autologin for the credentials just used on this url?') is an option that has been enabled by the user in the settings.
4 (extra) After a future unsucessful try, it will stop and highlight the error (eg: 'warning: wrong password'). In this way, keepassxc will surpass lastpass funcionalities, as typically autologin must be manually enabled but it's global! In fact, even Kee: it continues to reload the page in this scenario.

I understand this is hard work, everything else is well done in keepassxc. This will be a killer feature for me and everyone I know.

[varjolintu]

This kind of per-site option is possible to implement in the future using Site preferences.

[droidmonkey]

I encourage you to read this article: https://www.ghacks.net/2017/12/31/how-web-trackers-exploit-password-managers/

I endorse the per-site opt-in for this feature.

[nestukh]

easyprivacy list via ublock origin already blocks that. I believe who uses keepassxc are most likely concerned individuals, and take precautions already. Using umatrix, noscript etc sites can be manually approved script by script.
But not everyone is tech-savvy (and understands how websites are coded, or even what code is), so if their security processes are not kept to a minimum effort, a lot of errors and wrongdoings will be introduced for sure, and the general level of security will suffer a lot more. It's like telling them «just aileron roll adjusting the torque via the angular momentum stored in the back gyroscope». I'm not talking about adding some insecure fingerprint reader, just simplify life to normal humans, where the enviroment is already secured enough.

[varjolintu]

When we have the next version released, we are able to add the feature to the Site preferences as per-site opt-in.

[nestukh]

It will be super

[AdamPS]

[Sorry I accidentally duplicate commented then accidentally both were deleted - but luckily I now have the chance to explain myself more clearly.]

Great feature idea, thanks!

I agree that "Auto-fill" is dangerous - thank you to the team here for being one of the few password managers that recognise that. "Auto-fill+submit" is obviously even more dangerous and I can see why you aren't keen on that.

I have been using RoboForm and I really like the way it works there. It's really simple:

• There is a is a key combination for "Fill", just like Alt+Shift+U in keepassxc
• And another one for "Fill and submit". If there are multiple matches, it shows the select list then submits after.

I almost always use "Fill and Submit". However if it's a new site and I'm not sure the right fields will be filled, I use "Fill". NB this extra key needn't be instead of per-site opt-in - both could be available.

Personally I'd prefer not to have to do a per-site opt-in. It's tedious for someone migrating from a different tool or sharing the database with other apps. After a while the user gets bored and clicks yes automatically so I would like there to be a "advanced/dangerous" option to skip the prompt.

One other thing we could do: fix Alt+Shift+U so that it leaves keyboard focus in the field filled, hence the user can just press enter.

[h-h-h-h]

Related functionality request

This is not about autofill, but autocomplete; this option from the settings:

• [x] Activate autocomplete for username fields.

Show a dropdown list containing available credentials for all username fields on a page.

When I choose a login name from the drop-down list, I would want the browser extension to not only fill the text boxes, but also submit the form.

If the respective new option that will control that behavior is set, the drop-down menu could even contain a message like that:

[varjolintu]

That kind of message looks very informative. Thanks for the idea!

[varjolintu]

I have been testing this a little. If the username/password is wrong with single entry auto-fill, the auto-submit will keep the login page in a infinite loop. With auto-fill, this must be definitely disabled.

[nestukh]

First, I thank you for working on this, I appreciate that

If I remember correctly, it's the same behavior of lastpass (which I don't use anymore). Maybe set up a warning and stopping after a small threshold of failed attempts, like 5? Sure lastpass hasn't got that

On a positive note, non-tech-y elderly people have proven to be able to push 'login' buttons on their own, after login auto-filling (mine was not a scientific study with a control group, only anedoctal evidence from a small sample of individuals), if those are easly spottable on websites, but only on computers with large screens or very increased font size, not on mobile!

And keepassxc works even on sites that lastpass wasn't able (ironically, an Italian bank site with some 'no autofill' code for text fields, for their own personal security reasons, which must be remain unnamed because it works well as it is now and I don't want them to know lol)

On less well designed sites, eg with dropout login menus, or on mobile this feature sure will help a lot anyway!