pwdhash-webextension appears to stop the letter Q being entered in Google Mail

[jnpwly]

Using Firefox 65.0b1 (64-bit) on Windows 10

When I compose an email using Google Mail, it appears as though this (really useful) extension is preventing the letter Q from being typed in the body of the email. If I disable this extension, I can type "Q", but if I enable it, the letter "Q" stops working.

It's really bizarre, and I've not had a problem with PwdHash in the past, despite using it for years (and years and years!)

If you need any other information from me, don't hesitate to ask!

[YellowApple]

I'm experiencing the same issue on Firefox Developer Edition 65.0b4 (64-bit) on Linux. In my case, it seems to affect all websites. Only lowercase q is affected (uppercase Q works fine). Disabling PwdHash fixes the issue.

Weirdly, the add-on hasn't been updated since last year. That suggests to me that some Firefox update broke it, though I haven't the slightest idea how that'd be possible (or why it would affect the q key of all things).

[quassy]

The problem seems to be somewhere in lines 63 to 90 of stanford-pwdhash.js:

/**
 * Password Key Monitor
 * Watches for the password prefix or password key
 */
function SPH_PasswordKeyMonitor() {
  this.keystream = new Array();
  window.addEventListener("keydown", this, true);
  window.addEventListener("keypress", this, true);
  window.addEventListener("keyup", this, true);
}

SPH_PasswordKeyMonitor.prototype = {

   keystream: null,

   protector: null,

   handleEvent: function(evt) {

     // Detect Password Key
     if (evt.keyCode == evt[SPH_kPasswordKey]) { 
       evt.stopPropagation();   // Don't let user JavaScript see this event
       evt.preventDefault();    // Do not let the character hit the page
       if (evt.type == "keydown") {
         evt.pwdkey = true;
         this.attemptPasswordKeyLogin();
       }
     }

This checks keydown, keypress and keyup events. If you log the keycodes for qwe this is the output

   down press    up
q    81   113    81
r    82   114    82
s    83   115    83

113 being the keycode for "F2" which is the standard password key, hence triggers the if clause and blocks the output. As "F2" does only trigger keydown and keyup but no keypress events (since December 2018), the easiest fix would be to remove the keypress event in line 70, but this will break the prefix (like "@@"). No idea why the keypress codes are wrong...

[quassy]

My pull request should fix the issue. I tried my best to test it but others should do as well before merging.

[affinityv]

Same problem in more places than just gmail, but I'm sure you all know that.

All pages I tried with user input, could not accept lowercase q, but seemed to be perfectly fine with any other normal character (including capital Q).

(firefox 66.0.2 was the first version I saw this problem btw)

[quassy]

Unfortunately, the maintainer of this repo seems to be inactive as my commit should allow the problem to be fixed.

Shameless plug: In the meantime you could use my extension PwdHash Sidebar, it works a bit differently: when you want to enter your password, press F8, type your password, press return and the hash is added to the clipboard, press Ctrl+V.

[berarma]

Shameless plug: In the meantime you could use my extension PwdHash Sidebar, it works a bit differently: when you want to enter your password, press F8, type your password, press return and the hash is added to the clipboard, press Ctrl+V.

That's even better than the original method. It failed in some pages.