1Password can't correctly fill in Tangerine password

mikepictor

On Tangerine.ca, when it's asking for the password, 1Password will fill in the password into the field (6 character dots show up), but if I try and login, the site will ALWAYS say I entered the wrong password.

If I type it in, or if I paste it in from the clipboard, it's fine, but the auto-fill does not match to whatever on-site validation is going on.

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

littlebobbytables

Greetings @mikepictor,

Can you try something for me please. Can you create a new Login item for this page using the steps outlined on our page "How to save a Login manually in your browser" ( https://support.1password.com/save-login-manually/ ). Having done so what I would be interested in learning is:

1. If you try filling with the new Login item can you successfully log into your account?
2. Do you see any difference in the password stored in the two Login items? By this I mean just inspecting visually.

I don't have personal experience with the site but what little exposure I've had from queries suggests we should work. What we're looking for here is evidence that might indicate something is wrong with the existing Login item even if the precise cause has yet to be identified or if there are password limitations being exposed by how 1Password fills. With the latter, 1Password can fill a longer password into a field than the field allows while copy and pasting will often truncate. We have seen this occasionally hence looking for it here. We either narrow in on the cause or we at least eliminate a couple of possibilities as we help troubleshoot this Login item.

mikepictor

Ok, you are on to something fascinating here.

I got to the password page, typed in my password, and then went to the create new login page. I called it "Tangerine 2". I then don't log in, I go back to the root page, and click the "I'm a client let me in" link, and progress through to the password page again.

Now before doing anything else, I inspect the 2 Tangerine records I have in 1Password. The old one is there, full of info (also my security questions, my transit #, etc...). The new one is there, and ONLY has a link. It doesn't even show a password. There is a button on this record called "show web form details", and it has one single field called "login_pin", which contains my password.

So...THIS record works. If I select Tangerine 2 to fill in my password, it works. If I select the original record, the password does look like it's being filled in, but it does NOT work. In the original record, I look at the web form details, and it doesn't have an entry for "login_pin"...so I add it. This doesn't work, I still get the same error as before. So, I remove the "password" field from web form details, leaving only "username" and "login_pin". This also has the consequence of removing password from up near the top of the record. I try and login again. Still no luck.

So finally, I remove username (semantically this is my client #) from the web form details and copy it instead into a random other field (since I don't want to lose it), so now the web form detail ONLY has login_pin.

That worked. My 1Password record no longer shows a name and password at the top of the record, but the web form does retain the correct data. It's not clear to me whether it was trying to paste in my client number maybe?

(if it wasn't clear, their "username" page is on a different page than the password)

mikepictor

we won't talk about the fact that they use a 6 digit numeric password for logging in. 6 characters, only numbers....that's my banking password. sigh

littlebobbytables

Hello @mikepictor,

I have something worth trying if you're happy to play about with this. Below you're going to find a block of text. It's a textual form of a Login item. What I would like you to do is copy it into the macOS clipboard like you would if you needed to paste it somewhere. Now switch to 1Password and as long as you have a real vault selected, not the All Vaults view, you should find there is a new menu option File > New Item from Clipboard which I would like you to use. This will create a new item based on the text in the clipboard. Next alter the username and password to match those for your account and save.

Do you find that this item correctly fills both pages and allows you to log in? I think it should but we won't know until you report back.

Now why do I think this will work where your original Login item didn't? I managed to poke around the site just enough to learn that their "password" field isn't even a password field, it's an input field designed for telephone numbers and the site is using JavaScript to replace the digits with ••••• rather than using a traditional password input field. I'd make a remark but given your last message about a 6 digit PIN I'm not sure there's much else to say. Please tell me there's another layer of security after that :cry:

{
  "URLs": [
    {
      "overview": {
        "label": "", 
        "url": "https://www.tangerine.ca/app/#/"
      }
    }
  ], 
  "categoryUUID": "001", 
  "details": {
    "fields": [
      {"designation": "username", "name": "login_clientId", "type": "T", "value": "username"
      }, 
      {"designation": "password", "name": "login_pin", "type": "TEL", "value": "peekaboo"
      }
    ]
  }, 
  "overview": {
    "ainfo": "username", 
    "ps": 1, 
    "title": "Tangerine", 
    "url": "https://www.tangerine.ca/app/#/"
  }, 
  "sectionName": "T"
}

mikepictor

They have a picture/phrase thing displayed to help make sure I am not on some phishing site, but no, nothing else (no 2FA or anything).

I'll play around with the json thing a bit later today. I need to get ready for work

mikepictor

Nope, didn't work. I kept simplifying your example, until I had the 2 fields both marked as text, and even that didn't work. Not until I removed the username entirely from the web form record could I make it work.

mikepictor

This is basically what my original record is. Anything beyond this seems to make it fail. I still wonder a bit whether it's pulling in my username into the password field, which is why it worked once I dropped the username from the webform entry.

My probably is basically solved (the site remembers my username, so I don't have anything to fill in for that page), so I am moderately happy, but if you want my help trying to iron out an even more ideal record, I'll do what I can.

littlebobbytables

Hi @mikepictor,

It may be we accept what we can as at least even if not ideal, you have a working Login item. Can I just ask, when you found the imported Login item based on my attempts did it not fill anything on the "password" page or was it at least filling the field but failing to make it past the submission? Just curious.

mikepictor

It behaved just like my original problem. The field seemed to get filled out, but it claimed I had the wrong value.

AGAlumB

Ah, thanks for letting us know! Indeed, some forms are setup in such a way that they are reacting to you typing manually...which is a bit of a problem for 1Password since it uses Javascript to fill. We'll see if there's something we can do to better work around that in the future.

opwerta

Having the same exact issue as @mikepictor.
It started about a month ago.
Had to change my bank pin for 4 times already!
I hope you AgileGuys can contact Tangerine and figure it out.
You are located in the same city – you can even visit them!

AGAlumB

I'm story to hear that. I'm not sure we'll be the ones to persuade them to adhere to web standards so that their site will allow their customers to use a password manager — or to allow for better accessibility. We'll see if there is anything we can do on our end to help, but ultimately we're not their customer, so they're more likely to listen to you folks than to us. :blush:

opwerta

Sure, I will let them know as well.
Thank you for the link @brenty.

dalton

Sounds good, @opwerta! :)

emtee33

This incompatibility between 1Password and Tangerine has been driving me bananas for months now. Has anyone figured out a workaround? I've tried a number of different things to no avail.

I did try and put a bit of pressure on them via Twitter, but clearly their social media team is only there as a first line of defence. I doubt my request actually made it to a product manager, much less developers...

https://twitter.com/TangerineBank/status/989612216856039424

https://twitter.com/TangerineBank/status/991751352412983296

littlebobbytables

Hi @emtee33,

The best we've found is to maintain two separate Login items, one for each stage of the sign-in process. Not great but you were always going to need to ask 1Password to fill on each page anyway as 1Password won't ever automatically fill a page. You can still use the keyboard shortcut ⌘\ (Mac, ctrl + \ on Windows) to fill as when it finds two matching items it will prompt as to which it should use.

emtee33

@littlebobbytables – yes! This is something I hadn't tried. So ⌘\ on login, select the first Login item, ⌘\ on the password page, select the second entry. Just tested now and it works. Not very elegant, but at least this prevents from having to manually copy from 1Password. Many thanks! :+1: :+1:

littlebobbytables

Now all you need to do is convince your bank that a 6 digit PIN is not great security. I've been told many banks in Canada are like this; I am surprised and dismayed.

AGAlumB

@emtee33: I'd encourage you to read this blog post and share it with your bank:

An open letter to banks

Not only because it makes a fairly good case for them reconsidering their policies and practices, but also because it illustrates how we've seen banks change over time in response to feedback from their customers. One of mine used to allow only 10 character passwords, and had a very hostile attitude toward security: not only would they try to prevent me from using a password manager, they actually "required" Internet Explorer 8 for using their website — and that was just a few years ago. So there is definitely hope, especially as more and more of their customers become security conscious and use password managers. :)

heelntoe

Thought I'd update this. I was able to do this with one login item. I first created a new login item from the PIN page, which created an incorrect entry in 1Password, making my PIN the username. I simply edited the username for the correct one and set the password to my PIN, and now when I login to Tangerine I simply ⌘\ on the username and ⌘\ on the password and it works perfectly.

ag_sebastian

Thanks so much for letting us know about the workaround, @heelntoe. :)

Gilles_Sergerie

Good day Sebastian. I use Tangerine on my IPad Pro and it works very well with face recognition from both the App and from Safari. My problem is with my iPhone 6 version 12.1.4. Neither the App nor Safari will launch 1Password to fill in the login pages. 1Password works well with my other bank on the same phone. Any suggestions?

Ben

Hi @Gilles_Sergerie

Have you tried Apple's Password AutoFill feature? 1Password can be set up as a data provider for that, and it is typically how we're recommending folks fill login items on iOS now:

Use 1Password to fill and save on your iPhone and iPad

Please let me know how it turns out.

Ben

sloot

@heelntoe Your suggestion worked perfectly. Thank you.

AGAlumB

Great! I'm glad to hear that helped. Enjoy your weekend! :)