palant / pfp

A simple and secure browser extension to be used with KeePass databases.
https://pfp.works/
Mozilla Public License 2.0
113 stars 14 forks source link

Change website name header in panel into a search #52

Closed kzar closed 6 years ago

kzar commented 7 years ago

Currently when you browse to a website and then open the Easy Passwords panel it says "Website name:" and then displays the website's domain below. If Easy Passwords couldn't figure out the domain you can click a link, type the domain, click OK and then view those passwords. It's useful how the current domain is populated, but very annoying to look up passwords or notes for other domains. Especially a problem with things like www. subdomains. That requires using the "all passwords" interface, which is cumbersome especially for a large number of entries.

LastPass has a search input there instead, which is very useful. As you type into the box the results are filtered and displayed immediately, so you can very quickly find what you want. On the bad side the current website's domain isn't populated automatically, so the user often has to type that in manually.

For the standard panel view I suggest that we remove the "Website name:" header completely, also the "Enter website name manually" interface. Then replace the website name field with an text input which can always be edited by the user. I think the field should continue to be populated with the current hostname automatically, but instead of only results which match exactly it should show any matches for domains which contain the string entered. When the user types or changes the value the results should be updated automatically. Here's a dummy screenshot to show what I mean. easy-passwords-search

Some questions:

kzar commented 7 years ago

(Also see the discussion in #41.)

palant commented 7 years ago

How about a less invasive change? I think that in almost all cases the users don't want to change the website name, so having this field as read-only and requiring an explicit action prevents mistakes. So I'd go with an explicit "Select website" link (or just "(select)" following "Website name"). Also, it seems that the text field needs an autocomplete dropdown - this should address the search requirements.

kzar commented 7 years ago

Well I think that clicking on the input and typing something is a pretty explicit action. I don't think it needs to be made more cumbersome, especially since searching for an entry is something I personally do all the time when using a password manager.

That said I like the autocomplete dropdown idea. If I can still quickly type a search query, click the domain I want from a list and then view or use entries for that domain I would be pretty happy, and it would be big improvement on the current interface IMO.

palant commented 7 years ago

I don't think it needs to be made more cumbersome, especially since searching for an entry is something I personally do all the time when using a password manager.

Several aspects here:

  1. That the text field is the initially focused so clicking isn't always required - often if one starts typing the current site name will be changed.
  2. There are currently two different actions associated with this text field: changing current website and creating an alias. It needs to be clear which one is currently being performed.
  3. If you are selecting a website manually all the time then this sounds like a bad habit. Not going with automatic website selection is bad because it exposes you to phishing attacks. There are exceptions of course but these should be just that - exceptions.
palant commented 6 years ago

I think that everything necessary has been implemented here, closing.

Noitidart commented 6 years ago

Wow this is a great feature. Lots of times when I signup for things, they have a seperate domain then the login page. Like https://login.live.com/ is the sign in domain but registration and other stuff happens on another domain, so at least for first time i have to do the search and say this shares login with X website.

palant commented 6 years ago

You should really use the alias feature then ("This website shares passwords with another"), manual selection exposes you to phishing attacks.

Noitidart commented 6 years ago

Thanks yep thats what I do, but for first time I always have to open the manager time, and then ctrl+f and find what else it is similar too (lots of times i dont realize the domain is different until this happens). And then I have to come back and type the domain. But with search freature its so easy I can just modify right there and pick. I havent tried out the search feature, just imagining that this is how it works. :D I can alias from a search right there in dialog Im thinking :D

palant commented 6 years ago

Yes, that is definitely easier now.