Can't fill in the login details for spectator.co.uk without modifying the website field?

mekondelta

When I use 1Password on iOS or Safari desktop to fill in the user/password for spectator.co.uk it never works. I can see that the login form uses an iframe like so:-

<iframe id="piano-id-F847N" name="piano-id-F847N" title="piano-id-F847N" scrolling="no" allowtransparency="true" src="https://id.tinypass.com/id/?client_id=wqo9s2cWVd&amp;sender=piano-id-F847N&amp;origin=https%3A%2F%2Fwww.spectator.co.uk&amp;site=https%3A%2F%2Fwww.spectator.co.uk&amp;display_mode=inline&amp;screen=login&amp;stage=TSE" style="overflow: hidden; background-color: transparent; border: 0px; width: 390px; height: 367px;" frameborder="0" class=""></iframe>

In order for me to get it to work, I had to edit the 1Password entry I have for spectator.co.uk to include the https://id.tinypass.com web site so that the browser plugin can fill in the details. Is this a bug or a known workaround?

---

1Password Version: 1Password 7 Version 7.4.1 (70401002) 1Password Sto
Extension Version: 7.4.1
OS Version: OSX Mojave
Sync Type: 1Password

Ben

Hi @mekondelta

It's a feature, not a bug. :) One of 1Password's core functions is to help protect you from phishing. It does this by refusing to fill into a form on a page that isn't part of the website listed in one of the website fields on your Login item. For example, this prevents things like filling your credentials for 1password.com on lpassword.com. At a quick glance to the address bar they may look the same. And lpassword.com could even present a login form that looks just like ours. But it isn't us, and you shouldn't be filling your credentials there.

In short: it is very intentional that in order for a form to be filled by 1Password the Login item you are trying to fill must have a website field that contains a URL that matches the page you're filling into.

I hope that helps. Should you have any other questions or concerns, please feel free to ask.

Ben

mekondelta

Thanks Ben! Doesn't look ideal for me to add tinypass.com but no choice it seems.

Ben

If spectator.co.uk is indeed legitimately passing their login process to tinypass.com then that would be the only solution. :)

Ben