Chrome suddenly asks to confirm 1PX autofills

cryptochrome

Hi,

I noticed this starting a couple of days ago: Whenever I ask 1PX to fill a form (username, password, you name it), Chrome presents its own little popup asking me to confirm. Every. Single. Time.

What is going on there?

Chrome version 80
1PX version 1.18

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

ag_ana

Hi @cryptochrome!

Can you please make sure that you have disabled the Chrome built-in password manager?

cryptochrome

Hi @ag_ana,

Chrome's password manager is disabled, and Chrome is showing that passwords are being controlled by 1P. The popup I mentioned is not a popup produced by Chrome's password managers. It's one of those blocking popups that are displayed right under the address bar and that prevent any kind of interaction with the browser until the popup is confirmed (similar to those old-school login prompts).

It's as if Chrome is intercepting 1P's autofill and makes me confirm that 1P is allowed to fill out the forms. Maybe something new in Chrome 80?

cryptochrome

EDIT: Note it's not showing for all form fills. I mostly notice it on forms where I fill in addresses, email and credit card info. It's not showing on logins.

ag_ana

@cryptochrome:

The popup I mentioned is not a popup produced by Chrome's password managers. It's one of those blocking popups that are displayed right under the address bar and that prevent any kind of interaction with the browser until the popup is confirmed (similar to those old-school login prompts).

Can you post a screenshot of this popup?

cryptochrome

Sure, @ag_ana, here you go:

This popup appeared the second I had 1P fill out my email address in a form.

cecelia

Hey @cryptochrome — Thanks for sending this screenshot over. That fill authorization prompt is a relatively new security feature we added. It'll prompt you to authorize filling in some forms so we can make sure it's really you asking to fill. This is extra protection for your credentials in case the possibility exists for someone (or some script) to steal focus and spoof interaction with the site you're on.

cryptochrome

Thanks @cecelia. How do I disable it?

kaitlyn

@cryptochrome – I appreciate your curiosity. :) The prompt when filling a Credit Card or Identity item via the inline menu cannot be disabled, but it would be nice for it to appear less often in the future. Cecelia hit the nail on the head explaining the reasoning behind the prompt – all in all, it's to make sure our users are as safe as they can possibly be when filling sensitive info. To avoid the prompt completely, you can fill Credit Card and Identity items from the 1Password X pop-up by clicking the 1Password icon in your browser toolbar and selecting the Autofill button next to the item you'd like to fill. In the meantime, I'd be happy to pass any feedback along that you may have for us. Feel free to share your thoughts with me!

cryptochrome

@kaitlyn

I appreciate you taking care of your users, but this doesn't make a lot of sense. At all. When I click on the autofill popup that appears on form fields I am giving my explicit consent to have the form filled out (otherwise, why would I click on the fill button?). So there is absolutely no reason to ask me a second time. There is a fine line between protecting your users and patronizing them, and in this case, you crossed that line.

Don't force something down my throat that I don't want to eat. And don't make me adapt unnecessary workflows just because you think some of your users might be lacking the IQ to understand what happens when they ask 1P to fill a field. So please make this an optional "feature". Because I am not stupid, you know? And I am pretty sure that applies to a lot of your customers, too.

dalton

You're right, @cryptochrome. The prompt isn't terribly useful when you're able to see and click on items in the inline menu. However, the prompt is useful when the inline menu is present but made hidden by the website (or other extensions) through the adjustment of certain elements and styles. The prompt ensures that you're intentionally filling Credit Card and Identity items, whether the inline menu is hidden or not.

We put a lot of effort into not requiring this prompt, as it introduces an extra step in the filling process, but found that a prompt was the simplest and safest solution for the time being. We'll continue to seek better solutions to this problem in the future.

cryptochrome

You don't have to seek for better solutions, you simply have to make this optional. Enable it by default, for all I care, but give me an option to make my own decisions. Again, forcing your users to adopt a workflow that they don't want is not just patronizing and extremely arrogant, but a recipe for losing customers. If this stays in the product, I am gone. And I will request a refund.

This is not ok. Simple as that.

kaitlyn

@cryptochrome – Thanks for the feedback! It's been passed along to our developers. If you have any other questions, we'll be here for you.

ref: dev/core/core#761

bradical

A little additional feedback here: I noticed this recently too and given that it doesn't happen all the time, my initial reaction was: did I do something wrong? I'm a fairly well-educated 1Password user so I think, if nothing else, you should try to include some addiitional info in the popup itself about what it is and when/why you might see it. I honestly thought something was broken for a while (e.g. I had a slightly different web URL associated with the login or something)

kaitlyn

Thanks so much, @bradical. I'm glad you shared your initial reaction. That's really helpful!

ref: dev/core/core#761

Unknown

This content has been removed.

ag_ana

Thank you for your feedback as well @MrMxyzptlk! :+1: