1Password hijacks key to pick textbox history item
In Windows, most browsers, as far as I know, will use form history to display a pick list when entering text into a textbox. If you want to select one of those values, you press arrow down, and can move up/down in the list using arrow up/down. But when 1Password is installed, arrow down will instead start browsing 1Password's list of matching logins. While both features are useful, I find it to be bad manners to hijack a generic keyboard function to do something else. 1Password should leave arrow down alone and use some other keypress for this purpose, at least if the browser has the history pick list open (which I'm not sure 1Password can detect).
I have tested/noticed this in Firefox extension for Windows. Other extensions and browsers are not tested, but I think the feature should be revised for all browser extensions to make sure it works as expected everywhere.
The workaround as it is now is to use the mouse to select an item from the browser's form history pick list. Works, but not as convenient as the keyboard.
1Password Version: Not Provided
Extension Version: 1.10.3
OS Version: Windows 10 Pro 64 bit Swedish
Sync Type: Not Provided
Referrer: forum-search:IDN
Comments
-
@krilbe: Sorry for the confusion. It isn't a keyboard function you're referring to, but rather the browsers built in password management feature conflicting with 1Password (X)'s. While we always recommend disabling that both for usability and security reasons, we don't actually have any control over it either way. But if you're unwilling to give up the browser's password management, you can always disable the 1Password X inline icon/menu in its settings, and use its toolbar icon for filling. Cheers! :)
0 -
Understood, partially. Firefox does however provide form filling using form history for all text boxes, regardless of its purpose. So, for example, for any textbox with a name "phone" will display suggested phone numbers that I have previously entered in other textboxes named "phone". To pick something from that list I can press arrow down. But for username fields, presumably having a name such as "user", "name", "username" or "login", 1Password will hijack the arrow down keypress even though only the browser's pick list is being shown, hide the browser's pick list and instead open the until now hidden 1Password list. Of course it's a feature to be able to access 1Password's list of suggested login matches using a keypress, but I strongly suggest to tie it to a keypress that doesn't clash with the browser's. E.g. Ctrl+Down or some such.
0 -
I might add that for backwards compatibility, you could simply introduce a setting to let the user specify desired keypress to bring up 1Password's list of matching logins. That would let all user's who don't care about the clash use it the way it's always been, but for me and others like me, who find it frustrating, enable us to select e.g. Ctrl+Down for 1Password's feature, avoiding the clash.
0 -
[REMOVED]
0 -
Firefox does however provide form filling using form history for all text boxes, regardless of its purpose. So, for example, for any textbox with a name "phone" will display suggested phone numbers that I have previously entered in other textboxes named "phone".
@krilbe: Right. That's all part of the browser's "password management" feature, for lack of a better term. Definitely a bit confusing.
Of course it's a feature to be able to access 1Password's list of suggested login matches using a keypress, but I strongly suggest to tie it to a keypress that doesn't clash with the browser's. E.g. Ctrl+Down or some such.
I really don't think we're going to do that. It just would't be discoverable. Who would think to try different key combinations there to interact with a hidden menu? We also don't want to add settings all the time, as that would not only make 1Password a mess and introduce a lot of confusion (things not working as expected because of interactions between different settings the user has chosen), but also greater opportunity for bugs or unexpected/unwanted side effects. That's not to say we can't consider this for the future. Certainly if it suddenly becomes an overwhelming source of difficulty for most users, we'll have to reevaluate. But to my knowledge it hasn't come up before. Frankly, it's not a great idea to have that browser feature enabled at all. It's far too easy to inadvertently squirt personal information into webpages with that. So actually, in a sense, 1Password X is protecting you from that in this case! Sort of kidding, but only a little. If you really do want to continue using it, you can always disable the feature in 1Password X as I mentioned above.
0 -
Understood, except that the feature I'm talking about is NOT part of the browser's password management. It's the form filling history, which doesn't have anything to do with entering credentials.
Dump from Firefox settings:
As you can see, I have password storage disabled (blue), but form history enabled (red). I appreciate that some of the items in form history can be personal and even sensitive, but it's also very convenient.Here's an example of the form fill feature in action for a non-credential textbox:
Pressing arrow down/up in this state will let me select a value from the history list, which I often do.But for some textboxes, presumably when the name attribute indicates that it's a user name field, 1Password hijacks the arrow down keypress and suddenly displays its own popup. For example, in Auth0, there's a dialog to edit a user's e-mail address. If I bring this up and start entering "k", for which I have 4 history items, this history list is brought up. Note that this is general form history, not Firefox credential storage.
If I want to pick one of them I hit arrow down. But when I do, I get 1Password's popup instead:
I find this very frustrating and I think your plugin should not intefere with standard browser behavior like that. I understand that a setting is undesirable, but I think the current situation is worse. A perfect solution would be for 1Password to detect if the browser has a history list visible, and if so not bring up its own popup (unless the user explicitly brings it up with Ctrl+period or whatever). I realize that this may not be technically possible though.
Furthermore, you've mentioned that the 1Password popup can be disabled. I tried disabling all General settings, but I still get the popup:
I will try with a browser restart after posting this. Please tell me how to disable the 1Password popup (which I would really prefer not to have to do).0 -
FWIW, after a restart of Firefox, the popup no longer appears. I tried different combinations and it's the "Show 1Password icon in forms" that needs to be disabled to avoid the popup. In that mode, Ctrl+period is required to use 1Password fill. Fair enough but not perfect.
May I suggest that the settings page informs the user that these settings don't take effect until the browser is restarted?
0 -
@krilbe: I personally think of form history as somewhat being part of their "password manger" function. Indeed, it's not passwords, but parts could be analogized to 1Password's Identities, for example. You'll notice in your example there, 1Password offered to fill an identity and had you chosen to do so, it should have filled the e-mail associated with that identity, much the same as Firefox's suggested data. It kinda stinks that Firefox lumps things like e-mails and addresses and phone numbers that 1Password can fill together with things like your description example that it can't. In my perfect universe, we'd be able to advise turning off your browser's suggestions for everything 1Password can fill while preserving suggestions where it can't and it seems that may not be possible in this case.
Also, you don't need to restart your browser for settings to take effect, but you do need to refresh any active pages. The icon is rendered on page load and doesn't update dynamically. A quick Ctrl + R will have you covered in the future. :chuffed:
0
