ING Direct internet banking and 1password

mattymcg

Hi folks. Long time customer, first time poster.

I have an issue with 1password and ING Direct's updated internet banking experience. The 1password "Create New/Update Existing" dialog box appears on almost every click of the internet banking experience (I have the Chrome browser extension installed). I'm guessing the ING Direct team are submitting a form with every selection of a navigation item or something. I've seen mention of ING Direct on these forums previously, in relation to their weird rotating PIN entry form. This dialog box also appears multiple times when logging in (although not every click—just the second digit, and occasionally the third).

While this internet banking site is still usable (I just have to hit Escape after every action), it's pretty annoying. I'd appreciate any feedback on whether this is something that I can resolve either by modifying a 1password setting, or if it's something the 1password team can/should address their end. Or whether I should approach the ING Direct team to request that they change how their internet banking portal is implemented (I have a fair idea of the chances of that). I'm using Chrome on a Mac.

Thanks
Matt

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Referrer: forum-search:ING Direct

jxpx777

Hi, @mattymcg. Sorry for the trouble you're having. I think I know what might be happening, but I need to take a closer look to confirm. Can you send us the URL for the page? I was an ING Direct customer for years, but now they're owned by Capital One and I log in through their system, which is quite different. Once we have the URL we'll be able to say more definitively what's going on there.

mattymcg

Sure, it's this: https://www.ingdirect.com.au/securebanking/

jxpx777

Thanks, @mattymcg. This is similar but slightly different to what I was expecting to see. In the page, the top left button of the keypad looks like this in the code:

<div class="key-cell pin uia-pin-0 style-scope ing-keypad" role="button" aria-controls="password" tabindex="0" position="0">
    <img alt="" class="style-scope ing-keypad" src="data:image/png;base64,[snipped by jxpx777]">
</div>

1Password looks for clicks on elements and one of the many heuristics we use is if the element the user clicked on, in this case the <img> tag "looks like" a button. One of the ways we determine this is to see if the element itself or one of its ancestors, the elements that it is nestled inside, has a role of button, which we see just in the <div> wrapping the <img>. We'll need to explore how to avoid the false positives here. Edit: In looking this over again, I see that there is a clue we can use to better avoid the autosave prompts here. I've opened a bug report to track it.

In the meantime, you should be able to get the prompts to stop by adding ingdirect.com.au to your list of autosave exclusions in 1Password > Preferences > Browsers.

I hope that helps. Let us know how it turns out.

ref: OPX-1225

mattymcg

Yep, that works great. Thanks so much!

jxpx777

Great! Glad that helped. :)

jonnyppp

+1

matthew_ag

Hey @jonnyppp,

Thanks for writing in, I see you've replied in another thread about this same issue. Please check out my reply there and let's continue our conversation in that thread.

Talk soon!

Matthew

mattymcg

Hi gang.

This issue has reared its ugly head again. I'm getting these prompts again, even though ingdirect.com.au is still in my browsers in 1password preferences. Any suggestions?

littlebobbytables

Hi @mattymcg,

Weird, I tried visiting the page but it didn't react as I clicked the buttons. Can you tell us a bit more about your setup please.

1. What version of 1Password do you have?
2. What browser do you use, is it still Chrome?
3. What version of the 1Password Chrome Extension do you have installed?

Maybe I need to test a different configuration to reproduce your findings which I'm happy to try.

mattymcg

1. Version 6.8 (680015)
2. Yes, Chrome
3. I'm not sure how to test this, but I think it's the latest

When you say it doesn't happen when you click buttons, are you logging in? It's not something that occurs during login; it's once I'm logged in and using the internet banking app.

littlebobbytables

Hi @mattymcg,

So I did misunderstand and thought we were talking about the login form. So once you're logged in, any and all navigation of the site results in the save login prompt appearing? When the prompt appears does it default to saving a new Login item or updating an existing one?

I'm not sure anybody on team will have an account with this bank and definitely not within the much smaller team that focusses on the extension due to where we're all individually located. So all the testing we've done has been on that first page, the only one we can visit.

I can only assume they have a password field somewhere, likely hidden, on the page for 1Password to be getting triggered like that but we also try only to react to fields that have changed. I'm not sure what their site is doing but I'm hoping there might be a workaround based on your answers.

dargentum

Hey @mattymcg,

I started getting these again too. It appears that ING is rebranding and have changed the domain for online banking to https://www.ing.com.au/.

If you add that URL to the exception list for autosave in 1Password > Preferences > Browsers as you did for the previous domain, this should fix your issue.

AGAlumB

@dargentum: Ah, thank you! That makes perfect sense then! :) :+1:

@mattymcg: Indeed, if they're using ing.com.au now, that would explain why the ingdirect.com.au exception isn't helping now. Give that a try.

mattymcg

Yep, that did it. Thanks @dargentum, thanks all :+1:

littlebobbytables

Nice observation @dargentum :smile: I still don't understand why all the pages after you've logged in are causing this behaviour, they must have something odd going on in the background of the page to trigger 1Password like that. At least the ignore list is proving useful in combating it.

chrish

I've been using 1Password for years and years so I've got some familiarity with the product.
Recently I opened bank accounts with ING and HSBC and with these 2 sites, I'm experiencing a frustration never encountered before.
Logging in via 1Password works fine. But, once logged in I get a pop up with every click "Create New or Update Existing." I dismiss by clicking Not Now and then click another menu option on the banking site - repeat, repeat, ................ ad infinitum.
FWIW, I'm using the latest Chrome on macOS High Sierra 10.13.3
I don't store passwords in Chrome.
Not encountering this issue with any other sites except when I would expect to i.e. when logging onto a site for the first time or when updating credentials.
Any assistance will be gratefully received.

---

1Password Version: 6.8.8 (688002)
Extension Version: 4.7.0.90
OS Version: OSX 10.13.3
Sync Type: iCloud

AGAlumB

@chrish: Indeed, I haven't seen anything like that either (or heard reports for other users), so it sounds like it is an issue specific to that website. Can you tell us the URL? It may be that one of us also has an account there and can test it. I can promise there will be anything we can do about it, if it's just a matter of how the site is coded, but we'll be happy to try — and frankly there's always something to be gained just by seeing how different sites work. If it's not something you want to share here on a public forum, feel free to shoot us an email at support+extensions@agilebits.com and post the Support ID you receive here so we can connect the dots.

But one thing you can do in the mean time if you just don't want to be prompted on that site any more is to click the "gear" icon on the autosave/update window next time to tell 1Password to "Never autosave for this site":

I hope this helps, and I'm looking forward to hearing back from you! :)

chrish

Hi Brenty, thanks for the response. The bank's url is https://www.ing.com.au/everyday-banking.html, however, the issue only arises once logged into an account so you will not experience it by simply clicking on the url. It would be interesting to know if there are any other ING customers in Australia accessing online banking via an OSX device.
The problem is specific to accessing my account via OSX. No issues at all when using the bank's app on iphone and ipad.

chrish

Hi Brenty, should have mentioned that my wife also banks at ING.com.au and uses a 1Password with a MacBook Air. She also has the same issue.

AGAlumB

Hi Brenty, thanks for the response. The bank's url is https://www.ing.com.au/everyday-banking.html, however, the issue only arises once logged into an account so you will not experience it by simply clicking on the url. It would be interesting to know if there are any other ING customers in Australia accessing online banking via an OSX device. The problem is specific to accessing my account via OSX. No issues at all when using the bank's app on iphone and ipad.

@chrish: Got it. Thank you! I'll see if anyone here has an account to test this with. If not, would you perhaps be able to save the HTML of a page where you experience the issue and "sanitize" it to remove any sensitive information (for example, if your account number is shown on the page)?

Hi Brenty, should have mentioned that my wife also banks at ING.com.au and uses a 1Password with a MacBook Air. She also has the same issue.

Thanks for adding that! It does sound like it's something to do with the way the site is designed then. :)

AGAlumB

@chrish: I knew this sounded familiar. It turns out that this is a long-standing issue with that site I've merged your posts with the existing discussion), but we actually have someone with an account there now who should be able to troubleshoot and get us some more details. I'm not certain there's something we can do there without breaking login saving for other sites, but perhaps we can find a workaround. Suffice to say, you don't need to provide any more details at this time. Thanks again! :)

mattymcg

Thought I'd jump in to say that ING have possibly changed something else, so that 1password is not working its magic to log in like it used to. I was resigned to not being able to populate the password on login, but now the issue I'm encountering is that it does not fill username either! This began happening maybe a few weeks ago. The HTML for the username field looks like this:

<input type="tel" id="cifField" class="uia-cif form-control input-lg style-scope ing-login-input" aria-describedby="login-warning" title="Client number" placeholder="Client number" maxlength="8">

Not sure if that's helpful. Let me know if you need anything else.

AGAlumB

@mattymcg: Thanks for following up! I made an edit to your post to make the markup visible (the browser just tried to render the HTML since it wasn't marked as code or pre-formatted). Unless I'm misunderstanding out of context, it looks like they're declaring it as a...telephone number. I cannot for the life of me recall how they were doing things before. Do you have some idea of when the change happened?

mattymcg

Yep, as mentioned it started happening a few weeks ago.

Let me know if I can provide anything else to help resolve this.

littlebobbytables

Hello @mattymcg,

As best I can tell ING have always used type telephone for their client number field. I went and tested the current version of 1Password 7 and I found it filled both fields. Now it appears to fill both correctly but as I don't have an account I can't make that all important step and say with no doubt at all that it definitely works.

In the past you mentioned 1Password 6, are you still on either 1Password 6.8.8 or 6.8.9? I can repeat my test for the previous version of 1Password for Mac and see if I find any difference.

I could easily be mistaken but I thought the core issue here was the save prompt incessantly appearing rather than not filling the PIN field. I have old test items but I didn't think to note if they didn't fill the PIN field correctly or not.

mattymcg

Thanks @littlebobbytables

I went and tested the current version of 1Password 7 and I found it filled both fields.

OK, well, that's promising!

Now it appears to fill both correctly but as I don't have an account I can't make that all
important step and say with no doubt at all that it definitely works.

I suspect that the PIN field, while it appears to be filled, doesn't actually register as containing a value when you click the Login button. But that's how it's always worked.

In the past you mentioned 1Password 6, are you still on either 1Password 6.8.8 or 6.8.9?
I can repeat my test for the previous version of 1Password for Mac and see if I find any
difference.

Nope, I'm on 1Password 7 these days (version 7.2.5 to be precise).

I could easily be mistaken but I thought the core issue here was the save prompt incessantly
appearing rather than not filling the PIN field. I have old test items but I didn't think to note if
they didn't fill the PIN field correctly or not.

You're right in that I first started this thread with the issue that the Save prompt kept appearing. Adding their domain to the ignore list fixed that easily. I could have started a new thread for this new issue, but I thought there might be value in keeping the "issues with ING" grouped together. Apologies if that has confused things.

In summary:

• The Save prompt has been a non-issue for a while. All good on that front,.
• Auto-filling the username field has always worked for me—until recently. Now it does not. Note this is true of both my work and personal laptops (both are Macbooks), so I'm surprised (and optimistic) to hear that it works for you.
• Separate issue, since you bring it up: auto-filling the PIN has never worked, as far as I know—the field appears to get populated with small "number hidden" discs, but the login process does not detect that this field has anything entered into it unless you use the rotating number pad to enter the PIN with your mouse. When you use the number pad, the "number hidden" discs that appear in the field are larger than the small ones that 1password populates it with.

1password PIN https://us.v-cdn.net/5020219/uploads/editor/4x/baargliqcr3i.png
When using the mouse: https://us.v-cdn.net/5020219/uploads/editor/qx/vyrw4dal7q7e.png

Hope that's clear!?

ag_sebastian

Thanks for all the details, @mattymcg! :smile:

While I doubt there's much we can do about the PIN if the site ignores our fill, you should be able to fill the username if you save a new login manually. Please give it a go and let me know if that helps. :)

mattymcg

OK, right you are—creating a new login manually fixed it. I should have thought to try that! :)

Yes no dice on the PIN, but that's always been the case (same deal with Google Chrome's attempt to do the same thing) so I'm resigned to that one!

AGAlumB

Awesome! Thanks for the update. I'm glad that helped a bit. :)