Issues with autofill on change password screen

eoren1

Longtime user of 1password and have been holding off on updating from version 6 but did so today - running 7.4.1 downloaded direct from Agilebits and using Safari 13.0.4 on an iMac (Catalina 10.15.2).

I decided to go through my long list of passwords and found lots that had weak ones.

One example was forums.macrumors.com

I went to that site, logged in and then went to change my password. I clicked the +Generate Password button in 1p mini and then Autofill but the program filled the field for the old password and left the two fields for new password blank.

I'm pretty sure that version 6 did not have these issues but can't check that now to compare. Also, I thought that version 6 allowed the user to generate a new password by right-clicking on the new password entry field for a more seamless process.

On a similar note, I had LOTS of duplicates that I cleaned up - mostly where I generated a password and then 1p saved the login credentials in a new entry. I noticed by clicking the +generate password as above, I know have two entries that show in 1p mini for the forums.macrumors.com site. Will the generated password entry be removed automatically?

Finally, one other new behavior (I think) is the inability to have 1p mini hit enter. I think that version 6 and that browser extension automatically hit enter/login after filling the username and password fields. Correct me if I'm wrong.

---

1Password Version: 7.4.1
Extension Version: 7.4.1
OS Version: OS X 10.15.2
Sync Type: iCloud

mjodotcom

I just started using 1Password and have been frusterated by similar behavior. When working through various kinks on generating new passwords (didn't fully meet site rules so trying again, etc) I start to build up a backlog of now saved "passwords" from the attempts that show up in the passwords category within the vault and also as suggestions to pick from when going back to the site. I have been just going in and manually trimming them out afterwards but would love to know if these clear on their own.

Also, there doesn't seem to be a rhyme or reason to when 1Password recognizes that I am in the act of changing a password and if I want to update the current credentials. Sometimes it asks and the process is painless, other times it just does nothing which case I have to make sure to note that it didn't get updated and manually go into the credential and paste in the new password.

Any help on these two topics would be appreciated, as they are definitely becoming hurdles to what I thought would be a seamless refresh all my passwords process.

ag_yaron

Hey @eoren1 and @mjodotcom !

1Password will automatically save any new password you generate as a "password" item as a failsafe - in case you change a password on a website and failed to update your login item with the new password (whether by mistake or by 1Password's inability to recognize the change password form as an existing login on that particular website). That is why you get new password items in the "Passwords" category in the app, and in the suggestions when you are on the website where the password was created.

You can easily remove all of these redundant password items as follows:
1. Open and unlock the 1Password 7 desktop app.
2. Click the "Help" menu at the top menu bar of your Mac.
3. Select the "Tools" submenu and then click on "Remove redundant generated passwords".

Alternatively you can simply go to the passwords category in the app, select them all with CMD+A and delete them.
We will not delete them for you automatically due to the importance of that failsafe.

Regarding the process itself not being as smooth as it can be - firstly I suggest you follow these steps whenever you change a password: https://support.1password.com/change-website-password/
Secondly, you'd be happy to know that we're constantly working on improving 1Password's autofilling logic and abilities to recognize forms and fields, so keep your 1Password up to date!

If you encounter issues on a specific website, let us know and we'll either find a solution or send that info to our devs so they can work with that info to better improve 1Password.

And finally, yes you are correct @eoren1 , the "auto-submit" feature was removed from 1Password due to Apple's security concerns in which extensions sent the "Enter" key on behalf of users and allowed malware to install itself. We removed the auto-submit feature because that is exactly what it did - sent the "Enter" key from your keyboard. You can definitely mimic that behavior on your own though - autofill on a website and then immediately hit Enter, that should log you in on the spot :)

I hope that answers everything, let me know if I missed something.

eoren1

Thanks Yaron

I looked at that URL but, in my example above for forums.macrumors.com, the change password process becomes very convoluted. It's more of a:

Generate Password
Save and Fill
Crap - it put the new password where the old one goes and now the old password is gone
Find old password in history
Copy from 1p and paste into correct field
Copy new generated password from 1p then copy into the two correct fields
Enter and then allow 1p to update existing entry
Delete the sole entry for a generated password

I found that, at least on Apple devices, it appeared to be MUCH simpler to use a combination of the Apple Keychain and 1password to effect the change:

Change password screen on website (on Safari)
1p to fill old password
Safari automatically generates strong passwords and auto-fills the two new password fields
Enter and allow 1p to update existing entry
Nothing to delete in 1p after

I had at least 50 weak passwords (mostly from forums I visited in 2009-2010 some of which are long gone) and found the second process to be MUCH smoother than trying to do this solely in 1password 7.

Again, can't be sure if my memory is correct but I feel like 1password 6 and the older extension was better about these change password fields - not just because it was hitting the Enter button for me.

mjodotcom

Thanks for the tip on duplicates. That does seem to cut the list down, but one does remain in there. I get what you are saying re: how its there for safety, does it not check the passwords against logins as well (just against other passwords)?

Still not sure why half the time when updating passwords I don't get the prompt to update the existing entry. I have also watched the video and sometimes it goes smoothly other times it never even asks me...?

ag_yaron

@eoren1 If you encounter this faulty process mainly in forums, I suggest you try this:
1. Get to the "change password" form.
2. Autofill with 1Password to get the "old password" field filled.
3. Generate a new password in 1Password and copy it. Do not autofill.
4. Paste it in the new password field(s) and hit Enter to apply it.

@mjodotcom I didn't quite understand your first question there. 1Password checks all your items, including password items and login items and compare them, if that is what you are asking.
The prompt to update a password will show up when 1Password detects a new password on a familiar URL. If the URL of the "change password" form is different than the URL of the website you initially saved it on, then 1Password might not realize they are related and won't suggest you save it. Furthermore, some websites are built in a way that prevents 1Password from working properly and this is where we are working non-stop to improve 1Password and overcome these limitations :)

eoren1

Yaron,
I still think that 1P can improve on this.
I just changed my master password for 1P on your site. I created my own password and 1p did not offer to update the currently stored password. I had to edit the field manually after.
Eyal

ag_yaron

Hey @eoren1 ,
1Password is constantly being developed and improved non-stop.

Thanks for noting that issue on our website, I'll forward it to our devs. If you have a membership account with us, I suggest you give 1Password X a try, it contains many autofilling improvements that have not yet made it into the 1Password extension and does recognizes most "change password" forms. If you're using Safari as your main browser, then hopefully we will have a Safari version of 1Password X in the near future.

In any case, just keep your 1Password apps and extensions up to date, improvement is gradual but constant :)

eoren1

New issue and not sure if I should start a new thread

I decided to try the Family plan and installed 1p on my wife's Macbook which currently uses the built-in Safari keychain. Got 1p set up and made sure preferences were set to watch for password entry. Signed out of Amazon and back in using TouchID and Safari/Keychain autofilled the login then password and 1p sat there silently doing nothing. Tried quitting Safari and restarting then logged out of Amazon and back in - nothing.

I can't use 1password X as I prefer to use Safari (as does she). One of the main reasons for me to upgrade to 1p7 was to get back the Safari integration that I lost in 1p6.

ag_ana

@eoren1:

Signed out of Amazon and back in using TouchID and Safari/Keychain autofilled the login then password and 1p sat there silently doing nothing. Tried quitting Safari and restarting then logged out of Amazon and back in - nothing.

It sound like you left the built-in Safari password manager enabled. It will interfere with 1Password if you leave it like there, as you have discovered, so we recommend disabling the feature in your browser. If you want 1Password to be your password manager, there is no need to let Safari interfere with this ;)

eoren1

Hi @ag_ana - I did keep the built-in password manager but don't see a way around this.

My wife has been using the Mac OS Keychain to save her passwords. I would like to have 1password working to help save these passwords under a Family plan and also offer some other features that the built-in program does not offer such as more credit card info.

Since her passwords are saved in the built-in program, I need that one working to fill in the fields for 1p to then catch and save.

Also, as noted above, 1p7 has been far worse than 1p6 in terms of changing passwords and I have had to use the built-in program to generate passwords (which 1p7 has mostly saved).

Feel like a bit of a Catch-22 situation but have to say that 1p6 and the older extension worked perfectly hand-in-hand with the built-in keychain program. Never had issues before.

ag_yaron

Hey @eoren1 ,

It is ok to keep the Safari built-in password manager active. We simply recommend deactivating it due to the confusion it causes for most users.
Since Amazon switched to a multi-page login process (email in the first page, password in the second page), you will need to save both pages as described here: https://support.1password.com/create-multi-page-login/

Once you have saved it, you will be able to autofill both steps of the login for Amazon.
On any other website where the username and password are on the same page, autofilling with Safari and logging in should trigger 1Password's "save new login" prompt, and allow you to save it in 1Password.

Let me know if it does not work for you on other websites as I described.