Save new login: CAPTCHA saved as username

Options
KevinSayHi
KevinSayHi
Community Member

The problem I'm about to describe is far from precise and reproducible, and not easily made so. Please bare with me.

It seems to me that once upon a time (maybe back to the 1P3 days), automatically saved new logins are very accurate, in the sense that usernames are usually correct, and the "web form details" section contains a lot of information. For instance, the "web form details" section of my AgileBits forums entry (created about a year ago, but I've been using 1P for much longer than that) contains the following keys: Email, Name, Password, PasswordMatch, recaptcha_response_field, TermsOfService, and RememberMe. A lot.

Recently (maybe starting from 1P4, not sure) "web form details" seems to have shrunk a lot to just username and password (which are not details anymore, but that's not necessarily a bad thing — although I do miss the real details). However, one thing that is particularly annoying is that the automatic saving accuracy also decreased a lot. I won't name the sites, but recently I found that as long as there's a CAPTCHA in the sign up form, the CAPTCHA is usually saved in the username field, instead of the username. At least 60% of the time, I'd say.

Maybe it's time to optimize the detection algorithm (or bring the old algorithm back, which seemed to worked great and provided a lot more web form details)? Thanks.

Comments

  • KevinSayHi
    KevinSayHi
    Community Member
    edited August 2014
    Options

    Sorry, forgot to mention the version. I'm now using:

    1Password
    Version 4.4.1 (441006)
    Mac App Store

    But I think the problem also occurred when I was on the beta channel (I switched back to stable about a month ago).

  • sjk
    sjk
    1Password Alumni
    Options

    Hi @KevinSayHi,

    Thanks for reporting this issue you're having with auto-save inaccuracy.

    … the "web form details" section of my AgileBits forums entry (created about a year ago, but I've been using 1P for much longer than that) contains the following keys: …

    Recently (maybe starting from 1P4, not sure) "web form details" seems to have shrunk a lot to just username and password (which are not details anymore, but that's not necessarily a bad thing — although I do miss the real details).

    If you create a new Login item on the registration page you'll see all those other fields in the Web form details section after clicking show web form details in the item details, e.g.:

    However, one thing that is particularly annoying is that the automatic saving accuracy also decreased a lot. I won't name the sites, but recently I found that as long as there's a CAPTCHA in the sign up form, the CAPTCHA is usually saved in the username field, instead of the username. At least 60% of the time, I'd say.

    It would actually be helpful if you did name any specific sites/pages where that happens so we can further investigate here. Our forum registration page appears not to be one of them. :)

    Thanks!

  • KevinSayHi
    KevinSayHi
    Community Member
    Options

    Hi @sjk‌ ,

    Thanks for your response.

    If you create a new Login item on the registration page you'll see all those other fields in the Web form details section after clicking show web form details in the item details, e.g.

    Exactly, this is exactly the right behavior I was talking about in the second paragraph. However, recently I had a lot of web form details like this:

    I tried to reproduce this just now but failed. Maybe I didn't get prompted during signup so that I only saved the entry from a login form later. Sorry for the false alert.

    It would actually be helpful if you did name any specific sites/pages where that happens so we can further investigate here. Our forum registration page appears not to be one of them.

    Sure. I didn't provide specific sites since 1. privacy concern; 2. can't remember :). However, below are two examples, one involving accounts.google.com, and one involving speedtest.net. Looks like they have non-standard field names, so 1Password is confused. (These days there are a lot of non-standard field names in signup forms, I guess.)


  • sjk
    sjk
    1Password Alumni
    edited August 2014
    Options

    Hi @KevinSayHi,

    Thanks for your followup.

    I tried to reproduce this just now but failed. Maybe I didn't get prompted during signup so that I only saved the entry from a login form later. Sorry for the false alert.

    No worries!

    Saving a new Login item manually on a sign in page, using credentials from an original item saved on a registration page, can often be useful when the original item isn't working. Sometimes extra web form fields saved during registration can be interfering, redundant, or unnecessary with logins. And when there is information there worth retaining it might be preferable putting it in custom fields instead.

    I didn't provide specific sites since 1. privacy concern; 2. can't remember . :)

    For 1, you're welcome to send me a private message if there's ever anything you'd want to share that way. Not much I can offer about 2. :)

    But neither probably matter now, thanks to these …

    However, below are two examples, one involving accounts.google.com, and one involving speedtest.net. Looks like they have non-standard field names, so 1Password is confused.

    Let's use the speedtest.net example. Here's an item I saved on the registration page, in edit mode:

    The reg_pw_1 and captcha_verify fields in web form details are incorrectly associated with the main password and username fields. Those associations can be corrected to look like this:

    It can be easier simply to save a new Login item manually in the login form, using credentials from the original item:

    And that leaves extra web form details baggage behind:

    Ideally, of course, the original item would be saved and later fill correctly so none of the extra effort would be required to get a working item. As you mention:

    (These days there are a lot of non-standard field names in signup forms, I guess.)

    And we improvements planned for 1Password to better handle these cases. I'm happy to let our developers know forms with CAPTCHA are particularly problematic for you. Thank you for reporting this!

    ref: OPX-144

  • KevinSayHi
    KevinSayHi
    Community Member
    Options

    @sjk‌

    Thanks for the comprehensive reply!

    Actually most of what you suggested are what I've already been doing. Regarding custom fields, most often I only manually enter them for pretty important accounts, and for unimportant ones (e.g., the speedtest.net one) try to have other details (if any) automatically saved in web form details so that I can retrieve them later if I want to. Having a few irrelevant fields is typically not a big concern since storage is cheap, and I'm happy with the current performance.

    You know what, I'm raising this issue not because I don't know how to manually correct wrong fields, but just because having something saved automatically and revising it by hand later becomes annoying after a reasonable number of times. In fact, this is by no means a bug/flaw/whatever. If 1Password never offered automatic saving and detection, I would be grateful for being able to manually key in entries, more so for custom fields. Technology sometimes makes people greedy and unhappy :).

  • sjk
    sjk
    1Password Alumni
    Options

    You're welcome, @KevinSayHi.

    Regarding custom fields, most often I only manually enter them for pretty important accounts, and for unimportant ones (e.g., the speedtest.net one) try to have other details (if any) automatically saved in web form details so that I can retrieve them later if I want to. Having a few irrelevant fields is typically not a big concern since storage is cheap, and I'm happy with the current performance.

    Same here, and since I tend to be a data hoarder some superfluous web form details.don't normally bother me. :)

    … I'm raising this issue not because I don't know how to manually correct wrong fields, but just because having something saved automatically and revising it by hand later becomes annoying after a reasonable number of times.

    Fixing issues caused by 1Password saving incorrect information, which we strive to minimize, does require some manual effort somewhere. I wrote:

    It can be easier simply to save a new Login item manually in the login form, using credentials from the original item:

    And that leaves extra web form details baggage behind: …

    Instead of saving a new Login item, an original item can be updated with auto-save when the username or password differs, while retaining other web form details. In the speedtest example, entering a valid address in the Email field of the login form will only replace the invalid one in the main username and web form captcha_verify fields when updating the item. You lose the original value, and still have the incorrect designation for username (which can be easily adjusted), but keep everything else. That would be an alternative to editing an item right after it's initially saved with invalid information that causes login failure, which may not be noticed until sometime later. I prefer leaving auto-submit disabled by default, making it easier to spot and correct invalid username fields.

    Editing an original item to correct errors (if possible) once they're discovered, without doing an auto-save update to it first, can sometimes be more desirable. Or saving a new item, and optionally deleting/renaming/archiving the original, may be necessary in some cases.

    But I'm not saying anything you don't already know. :)

    In fact, this is by no means a bug/flaw/whatever.

    The username being designated to a CAPTCHA field is an unsquished bug.

    If 1Password never offered automatic saving and detection, I would be grateful for being able to manually key in entries, more so for custom fields.

    Let's hope we never end up at that extreme and can continue reducing redundant manual entry.

    Technology sometimes makes people greedy and unhappy. :)

    I'd like to fully eliminate that. :)

This discussion has been closed.