search

keepassxreboot / keepassxc-browser

KeePassXC Browser Extension
GNU General Public License v3.0
1.72k stars 177 forks source link

SMS fields detected as individual TOTP fields #2315

Open paveldvorak5 opened 4 weeks ago

paveldvorak5 commented 4 weeks ago

Overview

The extension fills some fields that are not login fields

Steps to Reproduce

  1. Open a site that wants you to fill a SMS code like aukro.cz
  2. The SMS fields are filled by KeePass

Expected Behavior

No to change fields on the screenshot

Actual Behavior

See the image

Context

Possible solution: do no fill the fields bellow so minimal width or do no fill when too much input fields are found

KeePass Extension for Firefox - 1.9.2

image

droidmonkey commented 4 weeks ago

Please post the HTML excerpt associated with these fields.

paveldvorak5 commented 4 weeks ago

<auk-verification-code-input _ngcontent-ng-c1813823941="" class="display-block m-b-2" _nghost-ng-c1575450318=""><input _ngcontent-ng-c1575450318="" autocomplete="one-time-code" class="m-r-2 m-l-2 ng-star-inserted" inputmode="numeric"><input _ngcontent-ng-c1575450318="" autocomplete="one-time-code" class="m-r-2 m-l-2 ng-star-inserted" inputmode="numeric"><input _ngcontent-ng-c1575450318="" autocomplete="one-time-code" class="m-r-2 m-l-2 ng-star-inserted" inputmode="numeric"><input _ngcontent-ng-c1575450318="" autocomplete="one-time-code" class="m-r-2 m-l-2 ng-star-inserted" inputmode="numeric"><!----></auk-verification-code-input>

whole page in the attachment page.tar.gz

e-t-l commented 1 week ago

The problem is that those are TOTP fields. It's just that the TOTP generator is a proprietary web server that sends you a text, not a local app like KeePassXC. I'm not a dev here but I don't know how the extension could ever differentiate TOTP fields where you receive a text versus one where you open an app, because the website front-ends are identical.