Open
Bug 1119454
(password-recipes)
Opened 10 years ago
Updated 2 years ago
[meta] Support per-sites recipes for capturing and filling the user's login credentials
Categories
(Toolkit :: Password Manager, defect)
Toolkit
Password Manager
Tracking
()
NEW
Tracking | Status | |
---|---|---|
relnote-firefox | --- | - |
People
(Reporter: ckarlof, Unassigned)
References
(Depends on 4 open bugs)
Details
(Keywords: meta, Whiteboard: [passwords:recipes])
Attachments
(1 file, 1 obsolete file)
12.26 KB,
text/plain
|
Details |
The password manager uses a set of imperfect heuristics to capture and fill users' login credentials. Although we strive for these heuristics to work on as many sites as possible, they will unfortunately do the wrong thing sometimes. From past experience, I've found that having a lightweight, maintainable "recipes" system in the password manager can help both devs and end users fix errant sites. Some of things recipes can help with: * explicitly specifying the username or password field for a site (when our heuristics identify the wrong one) * explicitly specifying what is *not* a username or password field (similar problem to above, but a different solution) * supporting multi-stage logins (username on first page, password entry on second) * supporting multi-domain realms (multiple domains that use the same login credentials) * supporting multi-realm domains (e.g., mailman) * supporting sites that require multiple usernames to log in (e.g., email and subscriber ID for a health insurer) * supporting sites that use multiple password fields to log in
Reporter | ||
Comment 1•10 years ago
|
||
We'll need to decide on how we'll specify recipes. My previous project specified them in a YML file with a list of entries of the format <domain>: <config>. For informational purposes, I've attached that file to this bug. Take it with a grain of salt. The documentation in the comments is probably more useful than the actual configurations. Also, my previously project was trying more "ambitious" things, like form auto-submit and overlaying our own UI over the site's login form. There some recipes supporting that functionality which are likely going to be irrelevant. (Lesson learned: don't try to do auto-submit "forms" and don't try to alter the UX too much on the page. It's too fragile.)
Reporter | ||
Comment 2•10 years ago
|
||
Reporter | ||
Updated•10 years ago
|
See Also: → separate-page-username-password
Reporter | ||
Comment 3•10 years ago
|
||
Recipes to fix issues with HTTP Basic Auth and Digest Auth would also be handy.
Reporter | ||
Comment 4•10 years ago
|
||
Given the amount of noise in the initial attachment, I've pruned it down a bit to what's relevant.
Reporter | ||
Comment 5•10 years ago
|
||
Attachment #8546161 -
Attachment is obsolete: true
Updated•10 years ago
|
Blocks: separate-page-username-password
See Also: separate-page-username-password →
Comment 6•10 years ago
|
||
(In reply to Chris Karlof [:ckarlof] from comment #0) > * explicitly specifying the username or password field for a site (when our > heuristics identify the wrong one) > * explicitly specifying what is *not* a username or password field (similar I broke this part down into bug 1120129 so I can start making it block website bugs which will need that type of recipe.
Reporter | ||
Comment 7•10 years ago
|
||
:dolske raised the following point on IRC and I think it's a good one: 12:53 PM <@dolske> ckarlof: one thing we might want to consider for recipees... I wonder if we should have the ability for a recipee's domain to not be just a site (ie, literal DNS domain) but also something detected on any page. 12:54 PM <@dolske> the specific case I'm thinking of is mailman. 12:54 PM <@dolske> (although it might not be a great example) 12:55 PM <@dolske> being able to make a login specific to a particular path is needed there. If the recipee for doing that was per-host, it would grow to be a gigantic list. Having a "for pages that look like mailman, do this" kind of recipee would be useful.
Reporter | ||
Updated•10 years ago
|
Priority: -- → P1
Reporter | ||
Comment 8•10 years ago
|
||
This is ready to break down.
Reporter | ||
Comment 9•10 years ago
|
||
A recipe to support our Okta SSO would be a good starting place.
Updated•10 years ago
|
Assignee: nobody → MattN+bmo
Status: NEW → ASSIGNED
Flags: firefox-backlog+
Comment 10•10 years ago
|
||
Hi Matt, can you provide a point value.
Iteration: --- → 38.2 - 9 Feb
Flags: qe-verify-
Flags: needinfo?(MattN+bmo)
Updated•10 years ago
|
Iteration: 38.2 - 9 Feb → 38.3 - 23 Feb
Updated•10 years ago
|
Points: --- → 5
Updated•10 years ago
|
Flags: needinfo?(MattN+bmo)
Updated•10 years ago
|
Assignee: MattN+bmo → nobody
No longer blocks: separate-page-username-password, passwords-2015-Q1
Status: ASSIGNED → NEW
Iteration: 38.3 - 23 Feb → ---
Points: 5 → ---
Depends on: separate-page-username-password, 1134530
Flags: qe-verify-
Flags: firefox-backlog+
Keywords: meta
Priority: P1 → --
Summary: Breakdown: Support per-sites recipes for capturing and filling the user's login credentials → Support per-sites recipes for capturing and filling the user's login credentials
Updated•10 years ago
|
Alias: password-recipes
Comment 11•10 years ago
|
||
Release Note Request (optional, but appreciated) [Why is this notable]: Improved capability to manage passwords. [Suggested wording]: Not sure yet. Depends on what sites we have ready when we launch this feature [Links (documentation, blog post, etc)]:
relnote-firefox:
--- → ?
Updated•8 years ago
|
Whiteboard: [passwords:recipes]
Comment 12•7 years ago
|
||
Matt, did we more or less ship this? I don't want to keep this in release notes triage if we already shipped an earlier version, or if we don't have concrete plans to ship it.
Flags: needinfo?(MattN+bmo)
Comment 13•7 years ago
|
||
This is a meta bug and we shipped a few different recipe types in dependencies. I don't think we need to track a relnote for this meta bug.
Flags: needinfo?(MattN+bmo)
Updated•5 years ago
|
Summary: Support per-sites recipes for capturing and filling the user's login credentials → [meta] Support per-sites recipes for capturing and filling the user's login credentials
Updated•2 years ago
|
Severity: normal → S3
You need to log in
before you can comment on or make changes to this bug.
Description
•