Autofilling incorrect information (perhaps after auto-locking)
I can't seem to find anything quite like this issue in the forums, so here goes...
- Used 1P for a bit, everything appears normal.
- Moved on to other tasks long enough for 1P to auto-lock
- Switched back to Safari, created new window, entered URL in field for a site that requires password
- Site loads, insertion point in 'username' field. Trigger 1P with CMD-\
- 1P window shows up and asks for master password--entered correct password
- 1P window disappears and username/password info is auto-filled into the correct fields on the website
- However, it's the wrong login entirely (often the username is correct because so many sites want your email address as the username, but the password is from a different entry in the 1P database).
- Interestingly, it's always the SAME wrong login information, regardless of the website I'm trying to log in to.
Problem didn't appear after a reboot, but DID appear after letting 1P auto-lock, which is why I include that as a step to (potentially) reproduce.
Thoughts on how I can help troubleshoot this one?
1Password Version: 8.10.18
Extension Version: 2.17.1
OS Version: 14.1.2
Browser: Safari 17.1.2
Comments
-
Hey @bspachman, thanks for writing in. I appreciate the details you shared.
Does the incorrect Login item have a "Linked Apps" attached to it? Here's a screenshot for reference:
If so, edit the Login item and remove any Linked Apps then save the item. Once that's done, try to use Universal Autofill again in your browser. Let me know how that goes.
0 -
Thanks--indeed, the incorrect item had Safari associated with it as a 'linked app'. Here's the new behavior, and a bunch of followups:
NEW BEHAVIOR: following the steps in my initial post, the end result is that the "Quick Access" floating window now pops up, with nothing in it. In some ways, this is better, since 1P isn't actually filling incorrect information, but I now have to dismiss the floating window, make the Safari window active by clicking on it, then CMD-\ again for the autofill to actually happen.
Some questions...
- I had a hard time finding this discussion on a different device much earlier in my day. I thought I had posted in the "Mac" area. Any insight as to why we're now in the "1P in the Browser" part of the forum, and also, my personal feeling is that this forum area might be past its useful life, since (I think), nearly all the 1P8 stuff is driven "in the browser" :)
- How can I find other entries in my 1P database that have a "linked app" associated with them? There doesn't seem to be a way to search for that.
- What's the purpose of the 'linked app' feature anyway? Searching that phrase in the KB brings up no documentation about its utility, only a brief mention when linking your MacOS login info to the 1P database.
- Similarly, when I read that KB article (https://support.1password.com/mac-universal-autofill/), there's some talk about "Fill & Update". I feel that it's unexpected behavior to add a 'linked app' as part of that process. I'm sure my problem started with me wanting to save an updated password.
- Why would linking Safari override the URL matching?
Thanks in advance for any insight...
brad0 -
Bumping and confirming that the 'new behavior' still occurs with v2.18.0.
brad
0 -
Hi @bspachman ,
NEW BEHAVIOR: following the steps in my initial post, the end result is that the "Quick Access" floating window now pops up, with nothing in it. In some ways, this is better, since 1P isn't actually filling incorrect information, but I now have to dismiss the floating window, make the Safari window active by clicking on it, then CMD-\ again for the autofill to actually happen.
This sounds like expected behaviour from Universal Autofill. To provide some context, when Universal Autofill is invoked, if it is not able to locate a matching item in 1Password or if there are two or more items that match, a Quick Access window will open instead to allow you to search or select an item to be filled. If there is only a single matching item, then it will be filled. Note that the correct website address will need to be saved in the "website" field of the item in 1Password for filling in your browser.
When invoking Universal Autofill it will search for items based what is currently in focus. So if Safari was not in focus when you've used the shortcut, this may explain why it was not filled initially. If it was in focus and then the focus was then shifted, let us know and we can investigate this further.
I had a hard time finding this discussion on a different device much earlier in my day. I thought I had posted in the "Mac" area. Any insight as to why we're now in the "1P in the Browser" part of the forum, and also, my personal feeling is that this forum area might be past its useful life, since (I think), nearly all the 1P8 stuff is driven "in the browser" :)
It was likely moved by a moderator as the behaviour mentioned was happening specifically in Safari. The "1Password in the browser" section typically addresses the browser extensions, which are a separate download from the app itself on most devices.
How can I find other entries in my 1P database that have a "linked app" associated with them? There doesn't seem to be a way to search for that.
You are correct, I'm afraid there is no way to search for that at the moment. If that is something you would like to see added, let me know and I'll forward your feedback to the team.
What's the purpose of the 'linked app' feature anyway? Searching that phrase in the KB brings up no documentation about its utility, only a brief mention when linking your MacOS login info to the 1P database.
Similarly, when I read that KB article (https://support.1password.com/mac-universal-autofill/), there's some talk about "Fill & Update". I feel that it's unexpected behavior to add a 'linked app' as part of that process. I'm sure my problem started with me wanting to save an updated password.
Why would linking Safari override the URL matching?The "Linked App" essentially is what gives 1Password permission to fill that specific item into that specific app. This is in part a security feature to prevent your logins from being filled where they shouldn't. A Linked App can be added to an item with the following steps:
1. Open a login screen in a macOS app.
2. Invoke Universal Autofill or Quick Access and select an item to fill.
3. A new window will open with several options.
- Selecting "Fill Login" will fill the selected item without creating a Linked App.
- Selecting "Fill & Update Login" will let 1Password know that you want to use this item to fill in this app in the future and will create a "Linked App" in the item. Moving forward this item will be filled automatically into that app when invoking Universal Autofill.The behaviour that you've encountered was due to a previously known issue with Universal Autofill where using it in the browser could add the browser as a "Linked App", causing it to fill the specific item every time Universal Autofill was invoked in that specific browser. While this issue was resolved quite some time ago to prevent web browsers from being added as "Linked Apps", it did not remove existing links, causing the behaviour that you've encountered in your original post.
I hope this helps clear things up. Let us know if you have any questions moving forward.
0 -
TimG1P--
Thank you very much for the details & thoughtful response. Another follow-up...
NEW BEHAVIOR: following the steps in my initial post, the end result is that the "Quick Access" floating window now pops up, with nothing in it. In some ways, this is better, since 1P isn't actually filling incorrect information, but I now have to dismiss the floating window, make the Safari window active by clicking on it, then CMD-\ again for the autofill to actually happen.
This sounds like expected behaviour from Universal Autofill. To provide some context, when Universal Autofill is invoked, if it is not able to locate a matching item in 1Password or if there are two or more items that match, a Quick Access window will open instead to allow you to search or select an item to be filled. If there is only a single matching item, then it will be filled. Note that the correct website address will need to be saved in the "website" field of the item in 1Password for filling in your browser.
When invoking Universal Autofill it will search for items based what is currently in focus. So if Safari was not in focus when you've used the shortcut, this may explain why it was not filled initially. If it was in focus and then the focus was then shifted, let us know and we can investigate this further.
I think further investigation is needed. Before replying, I checked the behavior I'm seeing again.
- 1P was locked (in this example, probably due to inactivity).
- New window in Safari, type part of a URL needing username/password (let's say a banking site)
- Let Safari autofill the rest of the URL, hit 'enter' to accept and go to site
- Insertion point in 'username' field of site
- CMD-\ to have 1P fill in the information
- Main 1P window appears, asking for master password
- Correctly enter master password, main 1P window is replaced by the "Quick Access/Universal" window with no information from the 1P database in it. Can confirm there is only a single entry for that site in the 1P database.
- Press 'esc' to dismiss the Quick Access/Universal window
- CMD-\ again to actually fill in the data
So...still confused as to why 1P doesn't auto-fill the requested information from its database directly once my master password has been entered. Does the URL from Safari need to match the entry in 1P EXACTLY? My test case has the bank's homepage saved in 1P, but when I trigger 1P, I'm actually on the password entry page, which has an extended URL in the bank's domain space.
As for the remainder of your reply...
I think it would be great to be able to find entries with linked apps in the 1P database. I can easily see folks changing their workflows as new apps are developed and want to replace old information (though maybe "Fill & Update" appends new apps instead of replacing?)
I'd encourage the team to elaborate on the 'linked apps' feature in the documentation--I'm assuming that it's useful for macOS apps that have their own logins (Twitter, Adobe apps, etc. etc.....) and NOT meant for web browsers.
Thanks again, and let me know if you need more details about what I'm seeing happen with auto-fill...
brad0
