How can I make 1Password X to really auto-fill login credentials witout extra clicks?
I want to have 1Password X to effectively auto-fill the login form without extra user action. This is happening at least with Firefox on MacOS but I suspect this is a general behavior, even if the both completing checkboxes are checked in settings.
This should work as default at least for the case where there is only one suggestion.
This does not happen and the user needs to click on the "blue" icon and on the dropdown to select the login. This is impacting productivity and in few cases is even very hard to perform (if the web page already has some super custom design which conflicts with 1password popups).
1Password Version: latest
Extension Version: 1.12
OS Version: Firefox on MacOS
Sync Type: Not Provided
Comments
-
Hi @sbarnea,
So there are a couple of scenarios and they do have differences.
- A single sign-in page for a site. Facebook and Twitter are good examples.
- Sites that spread the sign-in process over multiple stages e.g. Amazon and Google.
For the first scenario, manually visiting the sign-in page will never see the fields filled without the user first initiating filling. It's for reasons of security that we do this. 1Password does allow the chaining of two commands which we refer to as open-and-fill. This only works by loading the stored URL and then filling but it still has to be initiated by the user. If you're visiting a manually page and fields are filled automatically it is likely that 1Password isn't involved.
For the second scenario the above still holds true for the first stage but if 1Password X can only fill a username on a page, after this page submits if there is a password field 1Password X infers this is a multi-stage sign-in and will fill the field but only because it partially filled the page beforehand. It blurs the line a little bit between convenience and the security noted earlier but it's important that 1Password doesn't view any and all pages as something it should be trying to fill without some user interaction first. Some browsers are known to try and detect automatically and fill with no user intervention and those approaches have been shown to be weak to certain attacks. It was true back in the 90s (I think) when I first heard of this and it was shown to still be true not that long ago.
0
