search

mozilla-lockwise / mozilla-lockwise.github.io

Take your passwords everywhere
https://lockwise.firefox.com
Mozilla Public License 2.0
46 stars 11 forks source link

Lockwise does not utilize the full Website Address that is input and instead truncates to just the Domain Name #147

Open dewrox opened 4 years ago

dewrox commented 4 years ago

Reproduction Steps:

  1. Create new Credential with website address of: https://citiretailservices.citibankonline.com/RSnextgen/svc/launch/index.action?siteId=PLCN_HOMEDEPOT&langId=en_US#signon Username: TestAccount Step 1 - Create first Credential
  2. Save new Credential
  3. View Credential from step 2 and notice that for Website Address it only saved: https://citiretailservices.citibankonline.com Step 3 - View first Credential
  4. Create new Credential with website address of: https://citiretailservices.citibankonline.com/RSnextgen/svc/launch/index.action?siteId=PLCN_COSTCO&langId=en_US#signon Username: TestAccount Step 4 - Create Second Credential
  5. Save new Credential and Receive Error Step 5 - Recieve Error

Conclusion:

If you have a Citibank CC entry stored for Home Depot https://citiretailservices.citibankonline.com/RSnextgen/svc/launch/index.action?siteId=PLCN_HOMEDEPOT&langId=en_US#signon

but you also have a Costco CC https://citiretailservices.citibankonline.com/RSnextgen/svc/launch/index.action?siteId=PLCN_COSTCO#signon

Since Lockwise truncates the Website Address down to the Domain Name (with subdomain) then it doesn't see the two as unique entries since the Username for both is the same and we all know people can use the same username.

You should be able to save both logins separately as you really should not use the same password for both, the user can not be forced to change their username. By saving the entire address so that the Website Address remains unique you handle the potential problem of the users username is not always going to be unique.

This will obviously bring up the question of "Ok, but what are we supposed to do if the website owner makes a change and that URL is no longer legitimate?" and the answer is that if the user ends up on the domain of citiretailservices.citibankonline.com and a username and password box is on the page and that page does not match one of the two that you have saved above... give the user the option to use either of them.

And BOOM... Issue solved.

dewrox commented 4 years ago

Updated the Title to only describe the Issue needing to be fixed by removing the unintended outcome.