search

ttyridal / masterpassword-firefox

masterpassword for Firefox
GNU General Public License v3.0
33 stars 9 forks source link

Filled passwords not detected #19

Closed linwiz closed 8 years ago

linwiz commented 9 years ago

I'm experiencing issues with this addon when I try to login to @protonmail (Does this mention notify ProtonMail about this issue?). ProtonMail does not detect that this addon fills in the login password and decryption password, and reports that username and password are required when they are clearly filled in. I'm not sure where (this addon or ProtonMail) the issue lies, but ProtonMail is the only site where I experience this issue, but it is possible that this addon uses a method that causes other sites to have the same issue. My best guess is that the website is looking for keystrokes, but not seeing any from this addon. Is there another method of filling in the password fields securely that will allow the site to detect the password?

ttyridal commented 9 years ago

Hi,

The addon uses two different methods when entering password. When at a html input password field it will simply set the inputs value attribute. Additionally it will copy the password to the system clip board so you can paste it manually.

Now, protonmail has a sign-up queue, so I can't test it right away, but by browsing through their code it does seem like

1) They have had previous issues with password managers (common login problems faq) 2) They do some fancy input processing with keypress events as you mention - MasterPassword does not generate these events when writing directly to the html input element.

Does it work if you clear the pre-filled password and then paste from the clipboard?

I can potentially make masterpassword simulate keypress events, but (due to browser security) it's quite limited.

linwiz commented 9 years ago

It does work if I remove the prefilled password and paste from the clipboard. I can also type a random character in addition to the prefilled password and then remove the random character. I wonder if there is something they can do over at ProtonMail ( @jasonstockman )? to make their site more friendly to addons and extensions like this one. This extension does work fine on every other site I go to.

ttyridal commented 8 years ago

Hopefully this is fixed in 2.0.1pre2, now available in the beta-channel.