Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deal with hidden password fields #1385

Closed
keunes opened this issue Jul 28, 2021 · 6 comments
Closed

Deal with hidden password fields #1385

keunes opened this issue Jul 28, 2021 · 6 comments
Labels
wontfix

Comments

@keunes
Copy link

keunes commented Jul 28, 2021

The issue:

https://www.ethias.be/myethias/public/nl/connexion hides the password field by default:
afbeelding
As a consequence, the fill-and-submit button doesn't show up. I currently have two options:

  • I can activate the 'Only username option' - then the fill-and-submit button shows up on page load, but only fills the username and it activates the password field. But the password field then stays empty because I indicated only a username field should be considered.
  • I could keep 'Only username option' inactive - then I have to manually

Expected Behavior

As indicated in #1358 (comment), hidden password fields can/should/are better not filled automatically.
I would expect KPXC-browser to still offer me a way to log in without typing anything manually.

Current Behavior

See 'The issue', I guess.

Possible Solution

Thinking of another solution: I can imagine three options

  • even for sites that have the 'Only username option' activated, the fill-and-submit button is shown even after submitting for the first time (I'd have to click twice, but that's still an improvement)
  • even for sites that don't have this option activated, the fill-and-submit button is shown when there is only a username field (I'd have to click twice, but that's still an improvement)
  • the 'Only username' boolean is changed into dropdown, which adds the option 'Password initially hidden' (in addition to 'Both' and 'Only username'), possibly combined with a way to indicate a 'Submit button/link' (in addition to the existing options to select username, password & TOTP fields)

Debug info

KeePassXC - 2.6.6
KeePassXC-Browser - 1.7.9.1
Operating system: Linux
Browser: Firefox

Thanks a lot for your great work!
@varjolintu
Copy link
Member

I can try to add an exception for the site. I'm actually just looking at it :)

@droidmonkey
Copy link
Member

We really need to introduce the concept of a login workflow. This would be an enhancement to the custom fields picker, but allow you to navigate the site while picking.

@varjolintu
Copy link
Member

We really need to introduce the concept of a login workflow. This would be an enhancement to the custom fields picker, but allow you to navigate the site while picking.

I've already started it. Progressing, but slowly.

@varjolintu varjolintu added the bug label Aug 19, 2021
@heynemax
Copy link

I'm having a similar problem were the visibility check is not working correctly on https://b2b.dab-bank.de/smartbroker/
Because <html> has the element style opacity:0 no input element will be found. The function kpxcFields.isVisible(field) is failing on all elements because of this element style. Still all the elements are visible obviously in my browser. How can this be fixed?

@droidmonkey
Copy link
Member

droidmonkey commented Sep 23, 2021 •
edited
Loading

Use Auto-Type. Gonna just say right now we aren't going to code around asinine choices that specific websites make. That is how vulnerabilities occur.

@droidmonkey droidmonkey added wontfix and removed bug labels Sep 23, 2021
@heynemax
Copy link

I've created a tampermonkey script to sanitize this website and this made it work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
wontfix
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@droidmonkey @keunes @varjolintu @heynemax