1119083 - Breakdown: Support capturing and filling of login credentials on hulu.com

Status: NEW

(Toolkit :: Password Manager, defect, P2)

Description

[Chris Karlof [:ckarlof]]

Attachment: hulu.gif

hulu.com is a password manager gauntlet. In my experience, working on hulu.com means you work in lots of other places. When I hear about a new browser based password manager, the first site I test it on is hulu.com. :)

Some challenges on Hulu:

* it doesn't use a <form> element on http://www.hulu.com
* the login "form" is dynamically added after page load (i.e., no input type=password on page load)
* the password input is initially hidden and only becomes visible after the user focuses on the username or password field
* credential submission uses AJAX and does not navigate the page to a new URL
* the login form is on an HTTP page
* they have a totally different login experience on https://secure.hulu.com/account/signin, which *does* use a <form> element 

This makes capturing difficult because you can't rely on onsubmit or page navigation as a cue to ask the user if they want to save their credentials. It makes auto-fill challenging because the password field is not initially visible. The fact the whole thing is on an HTTP page raises security concerns.

Screencap attached.