Support of 3rd party password manager

bbinto commented 5 years ago

Why/User Benefit/User Problem

Allow users to fill in their logins from their preferred password manager, e.g. LastPass

What / Requirements

Show dialog/prompt to use 3rd party app to fill in login information

Acceptance Criteria (how do I know when I’m done?)

Password manager app can access Fenix
Fenix offers dialog to select preferred pwd manager
Fenix fills out logins automatically
Focus app parity

┆Issue is synchronized with this Jira Task

bbinto commented 5 years ago

The idea is to use 3rd party password managers to let users fill in their saved logins, it's not via FX sync, but rather via other apps, ideally via Lockbox.

We should talk to UX (@brampitoyo and @lime124 ) how we can make sure to surface the option for users to use Lockbox as a password manager (should be some UI provided inside Fenix to advertise for this).

lime124 commented 5 years ago

@bbinto as far as I can tell, all the UI is going to be either via the 3rd party apps or something provided by the OS. It doesn't seem like there's anything for UX to provide to simply access their passwords in the app of their choice. @colintheshots am I missing something?

@bbinto If you are you wanting some sort of specific Fenix UI that is getting new users to go and download Lockbox, I think that should be a separate GitHub issue from this one which is just letting people get access to whatever they are already using.

Am I misunderstanding something?

brampitoyo commented 5 years ago

@bbinto I’m confirming @lime124 that Lockbox integration will mostly rely on the Lockbox.app to implement an accessibility service that users will need to turn on inside Android Settings.

Something that looks like this:

lockbox-accessibility

After this feature has been toggled on, the user will get a suggestion UI when visiting any website (using any browser, not just Fenix) that contains username/password fields:

bbinto commented 5 years ago

Next Lockbox update early March

bbinto commented 5 years ago

Idea re: flow

Keep password in library, detect if Lockbox is installed, if not, promote, otherwise open Lockbox directly

GV has implemented Autofill API

bbinto commented 5 years ago

@linuxwolf to confirm if his test was done on Focus GV, and post results here.

linuxwolf commented 5 years ago

Original tests may not been using the GeckoView engine in Firefox.

However, after verifying "Latest GeckoView" is toggled on, can confirm that Lockbox can fill into a page on Firefox Focus for Android.

sandysage commented 5 years ago

I think this is also related: https://github.com/mozilla-mobile/reference-browser/issues/574

sandysage commented 5 years ago

Just to close the loop here, I believe we're planning to use the autofill api as @bbinto mentions above, and not the accessibility route. Further discussion in #550.

bbinto commented 5 years ago

I'd like to suggest that this ticket/meta/epic is about the support of 3rd party passwords in general, i.e Autofill API.

@sandysage your suggestions, covered in #821 and #550 is def. a wonderful "nice to have" but not required for MVP. We'll keep it in the backlog and personally, I think, at a high priority.

@sandysage - I wonder if your engineers could help out with this work instead?

bbinto commented 5 years ago

@pocmo and @st3fan - has the required A/C work been done (support of 3rd party password manager), and if so, has this been loaded into Fenix nightly yet?

mheubusch commented 5 years ago

@vesta0 do we need Fenix stories for this? The only stories seem to be for reference browser.

bifleming commented 5 years ago

@vesta0 are we not doing this Meta? what's the path forward?

reinhart1010 commented 5 years ago

Duplicate: https://groups.google.com/forum/m/#!topic/fenix-nightly/ImcINWPjbB8

reinhart1010 commented 5 years ago

Duplicate: https://groups.google.com/forum/m/#!topic/fenix-nightly/Yp0bDF47YiA

IndefiniteBen commented 5 years ago

To summarise the Google groups (though they aren't clear)/ explain the issue: The autofill API correctly pops up, but shows password for the package name instead of the URL of the site.

Using the 'draw over other apps' method of Lastpass filling, when I press search it puts "Firefox Preview" in the search box. If I search for a site and tap it, Lastpass asks me if I want to associate that site with the app "Firefox Preview". I searched for disqus and added it this way, which is why you see that listed along with my firefox sync account/s (I need to clean up my passwords...). You can't see the text because I'm using the Android Q Beta and dark mode, which is also broken in other apps. Screenshot_20190520-223155

Edit: Not duplicate, but mentioned here: https://groups.google.com/d/msg/fenix-nightly/7wkodVg_PsQ/rlrKMKBOBQAJ

vesta0 commented 5 years ago

We are in the process of getting 3rd party managers work in Fenix.

sv-ohorvath commented 5 years ago

See https://github.com/mozilla-mobile/fenix/issues/1635#issuecomment-496128571

bifleming commented 5 years ago

@vesta0 can you provide info on what is blocking this?

leonardehrenfried commented 5 years ago

I'm happy to provide test cases and/or do qa for this feature, as I'm missing it a lot.

vesta0 commented 5 years ago

@bifleming we are waiting for password manager providers to whitelist Fenix in their upcoming releases.

leonardehrenfried commented 5 years ago

@vesta0 Does it make sense for us as paying customer of these providers (Lastpass in my case) to ask them for support in order to speed this up?

vesta0 commented 5 years ago

Thanks @leonardehrenfried I believe the work is already in progress or ready to land on their end :)

vesta0 commented 5 years ago

Hi @sv-ohorvath we expect that Fenix has now been whitelisted on 1password, dashlane, Bitwarden, and LogMeIn. Would you please verify?

IndefiniteBen commented 5 years ago

I just tried with LastPass and get the same situation as in my previous comment.

sv-ohorvath commented 5 years ago

Hi @vesta0, I checked all the above. No changes indeed for any of them: LastPass:

when there are no matching sites, a popup "no matching websites" should be displayed with a button to add the website you are on. (works on Fennec)
when there are some other saved credentials, you can associate them with Fenix. But Fenix will show all credentials saved when there are no matches.
where you have associated a login with a matching website, it will only fill-in the password, the first time. The second time it works.

BitWarden is still the same v.1.22.0, from Feb 4, 2019, so it's not fixed yet, still the same behavior as before.

LogMeIn's password manager is LastPass.

DashLane: not showing any saved logins (works with Fennec).

1password: You have to manually add websites in 1pass, but there are no logins suggestions in Fenix. Works with Fennec.

vesta0 commented 5 years ago

Thank you @IndefiniteBen and @sv-ohorvath for testing. I will follow up with them.

arunsathiya commented 5 years ago

Thank you for your efforts in making third-party password managers available. I have nudged 1Password's Android team to take a look at this as well - 1Password forum post.

arunsathiya commented 5 years ago

Actually, giving it another try, I see 1Password's autofiller now. Unsure why it did not appear on the first attempt.

Edit to add: I probably spoke too soon here. While the 1Password autofiller appears, the 1Password results do not match the website I am on. I have posted about it here.

vesta0 commented 5 years ago

Thank you @arunsathiya for nudging and testing :)

tdsmith commented 5 years ago

The Lastpass update I received from Google Play Store this morning now shows the correct suggestions for Firefox Preview. 🎉

vesta0 commented 5 years ago

Great! Thanks for letting us know @tdsmith !

leonardehrenfried commented 5 years ago

@tdsmith Are you on the beta app of Lastpass or the ordinary release?

diablogriff commented 5 years ago

I'm on nightly resdm

On Sun, Jun 30, 2019, 6:19 AM Leonard Ehrenfried notifications@github.com wrote:

@tdsmith https://github.com/tdsmith Are you on the beta app of Lastpass or the ordinary release?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/mozilla-mobile/fenix/issues/87?email_source=notifications&email_token=AL6MAO5T3VMXTSQHMRMK7ELP5CXFTA5CNFSM4GH2FEZKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODY4MBTQ#issuecomment-507035854, or mute the thread https://github.com/notifications/unsubscribe-auth/AL6MAO3LYUDPKLXFBSXHDY3P5CXFTANCNFSM4GH2FEZA .

IndefiniteBen commented 5 years ago

I can second what @tdsmith said. I had to opt-in for the Lastpass beta and wait for the update first, but it worked immediately after installing the beta. Hopefully this change makes it to the stable Lastpass soon!

theovds commented 5 years ago

FYI: Today I received an update for Lastpass and it worked immediately. I'm not using the beta version.

cpeterso commented 5 years ago

FYI: Today I received an update for Lastpass and it worked immediately. I'm not using the beta version.

@theovds - What is the version number of the (non-beta) Lastpass that works correctly for you?

theovds commented 5 years ago

FYI: Today I received an update for Lastpass and it worked immediately. I'm not using the beta version.

@theovds - What is the version number of the (non-beta) Lastpass that works correctly for you?

It's version 4.10.4345 (Built: 6/27/19)

sv-ohorvath commented 5 years ago

FYI: The 3rd party apps like LastPass and Bitwarden won't work with the new Nightly package name (org.mozilla.fenix.nightly). The PlayStore version (the public release version) works now with both.

cpeterso commented 5 years ago

The 3rd party apps like LastPass and Bitwarden won't work with the new Nightly package name (org.mozilla.fenix.nightly). The PlayStore version (the public release version) works now with both.

@vesta0 and @sarentz - We should ask LastPass and Bitwarden (and others?) to whitelist our pre-release package names (org.mozilla.fenix.nightly and org.mozilla.fenix.beta?) and Reference Browser. Who do you recommend reaches out to these third-party password managers?

When we asked Google to whitelist Fenix for Android WebAuthn, we gave them Fenix's pre-release package names.

vesta0 commented 5 years ago

@cpeterso the package name is the same right now between prod and nightly so it might be a different problem. @st3fan what do you think?

I can reach out to them once we set up our separate nightly and beta channels.

vesta0 commented 4 years ago

Hi @sv-ohorvath would you please re-test this with 1password, dashlane, and Bitwarden and let us know the most recent status before I reach out to them? Thanks so much!

andreicristianpetcu commented 4 years ago

@vesta0 I tested with Bitwarden and it filtered the password corredtly based on the site! Nightly build.

matteocontrini commented 4 years ago

I can confirm that 1Password works as well

sv-ohorvath commented 4 years ago

@vesta0 Cannot search the list of all passwords on 1Pass saved from other apps. Can only see the passwords saved from Fenix. Chrome can search through all the website-related items in the vault. Dashlane only shows the autofill pop-up for Fenix, there should also be a hovering bubble (the app logo hovering) to search/add new passwords, like on Chrome. Bitwarden works ok with new/existing passwords. the device used: Pixel 3 (Android 9)

vesta0 commented 4 years ago

Thanks @sv-ohorvath do 1Pass and Dashboard work similarly to Chrome in Fennec?

sv-ohorvath commented 4 years ago

Hey @vesta0, tried to find out why they didn't work the same and it seems it's a time matter, the other saved passwords will appear but they need some time, Chrome and Fennec don't show the others immediately either. So all 3: Dashlane, 1Password, Bitwarden seem to work fine on Fenix Nightly. Should we close this?

*Oops, accidentally closed it anyway :)

vesta0 commented 4 years ago

Thank you @sv-ohorvath and all of our contributors who helped test this!

androidacy-user commented 4 years ago

I can confirm this isn't fixed. Latest LastPass beta isn't showing any AutoFill prompts, and it's been granted accesibility permission. Tried Preview and Preview Nightly.

Pixel 2 XL, Android 10

st3fan commented 4 years ago

@vesta0 it may be a good idea to re-test this - i am pretty sure we asked all of the password managers to whitelist all our build flavors but that was a long time ago so maybe it is a good idea to verify again

mozilla-mobile / fenix