1282579 - (webext-port-lastpass) [tracking] Support LastPass as a WebExtension

Status: RESOLVED WORKSFORME

(WebExtensions :: Compatibility, defect, P2)

Description

[Matthew Wein [:mattw]]

Chrome store link: https://chrome.google.com/webstore/detail/google-translate/aapbdbdomjkkjkaonfhkkikfgjllcleb?hl=en

Firefox testing link: https://chrome.google.com/webstore/detail/lastpass-free-password-ma/hdokiejnpimakedhajhdlcegeplioahd

The following errors are reported to the console:
1467060965352	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing background.persistent: Event pages are not currently supported. This will run as a persistent background page.
1467060965362	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing permissions.4: Unknown permission "unlimitedStorage"
1467060965364	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing update_url: An unexpected property was found in the WebExtension manifest.
1467060965364	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing author: An unexpected property was found in the WebExtension manifest.
1467060965365	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing minimum_chrome_version: An unexpected property was found in the WebExtension manifest.
1467060965365	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing omnibox: An unexpected property was found in the WebExtension manifest.
1467060965365	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing optional_permissions: An unexpected property was found in the WebExtension manifest.
1467060965365	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing requirements: An unexpected property was found in the WebExtension manifest.
1467060965365	addons.webextension.<unknown>	WARN	Loading extension 'null': Reading manifest: Error processing options_page: An unexpected property was found in the WebExtension manifest.

Comment 1

[Matthew Wein [:mattw]]

For the chrome omnibox permission, a grep of the source code reveals that the following API methods are used:

 - chrome.omnibox.onInputChanged
 - chrome.omnibox.onInputEntered

Comment 2

[Andy McKay]

From what I gather version 4 of lastpass is a WebExtension and just hasn't been launched yet.

Comment 3

[Andrei Petcu]

(In reply to Matthew Wein [:K-9, :mattw] from comment #0)
> Chrome store link:
> https://chrome.google.com/webstore/detail/google-translate/
> aapbdbdomjkkjkaonfhkkikfgjllcleb?hl=en
> 
> Firefox testing link:
> https://chrome.google.com/webstore/detail/lastpass-free-password-ma/
> hdokiejnpimakedhajhdlcegeplioahd
> 

Please post the AMO link to the Lastpass password manager. I want to help test :)
Other similar bugs have links to the ported addons in AMO.

Comment 4

[Andy McKay]

Version 4 is available from their website, https://lastpass.com/lastpassffx/ and is from what I gather a WebExtension, so I don't think there's anything else to do here.

Comment 5

[Andrei Petcu]

(In reply to Andy McKay [:andym] from comment #4)
> Version 4 is available from their website, https://lastpass.com/lastpassffx/
> and is from what I gather a WebExtension, so I don't think there's anything
> else to do here.

Can you actually install it? I get an error message "Nightly prevents this site form asking you to install software on your computer". It fails in Nightly (v52), DevEdition (v51) and Stable (v49).

Comment 6

[Andy McKay]

If you click "allow" it will let you install. That's by design for an add-on loaded from a third party site.

Comment 7

[Andrei Petcu]

Strange..... now the download works. I know how to click "allow", it's not the first extenssion I install.

It does not seem to be a web extensions from what I see. I downloaded it from the link above (it actually points to https://lastpass.com/lastpassffx/xpi.php for the actual download). I unzipped the file and it does not contain the manifest.json. It contains a bootstrap.js and install.rdf which from what I remember are for non-webextensions. Disclaimer: I never built a web extension or a bootstrap extenssion :D

Comment 8

[Michael Cooper [:mythmon]]

Attachment: lastpass-legacy.png

I have Lastpass 4.1.54 installed, and it is currently being marked as a Legacy add-on in Nightly, see the attached screenshot. I'm pretty sure it is *not* a web extension. It also isn't being marked as 57 compatible on AMO: https://addons.mozilla.org/en-US/firefox/addon/lastpass-password-manager/?src=search

Comment 9

[James Gilliland]

Some errors during firefox start that might be relevant:

console.error: LastPass: Free Password Manager: 
  Error opening input stream (invalid filename?): resource://support-at-lastpass-dot-com/data/onloadwff.js
console.error: LastPass: Free Password Manager: 
  Error opening input stream (invalid filename?): resource://support-at-lastpass-dot-com/data/onloadwff.js
console.warn: SDK worker-child started as frozen on unexpected initial document.readyState {"initialDocumentReadyState":"uninitialized","windowLocation":"about:blank"}
console.warn: SDK worker-child started as frozen on unexpected initial document.readyState {"initialDocumentReadyState":"uninitialized","windowLocation":"about:blank"}
console.warn: SDK worker-child started as frozen on unexpected initial document.readyState {"initialDocumentReadyState":"uninitialized","windowLocation":"about:blank"}
console.error: LastPass: Free Password Manager: 
  Error opening input stream (invalid filename?): resource://support-at-lastpass-dot-com/data/onloadwff.js
console.error: LastPass: Free Password Manager: 
  Error opening input stream (invalid filename?): resource://support-at-lastpass-dot-com/data/onloadwff.js
console.error: LastPass: Free Password Manager: 
  Error opening input stream (invalid filename?): resource://support-at-lastpass-dot-com/data/onloadwff.js
console.error: LastPass: Free Password Manager: 
  Error opening input stream (invalid filename?): resource://support-at-lastpass-dot-com/data/onloadwff.js
IPDL protocol error: Handler returned error code!

Comment 10

[beingalink]

The LastPass addon got disabled with today's nightly build. This is with version 4.1.62a which is the latest version I know of.

Comment 11

[Caspy7]

Any lastpass devs on this bug?
If so, any updates about the status?

Perhaps I skimmed too quickly. Is this a Firefox problem primarily?

Comment 12

[Jim]

Well its a LP extension issue with firefox. When I contact Lastpass Support this is the response I got from tier 1 support "LastPass is currently not compatible, but we are working towards this and will be compatible before it releases the stable version".

Comment 13

[Ed Morley [:emorley]]

I've added some users with lastpass.com email addresses to CC... hi and sorry for the mass CC!

Could you add any Firefox Web Extension API feature requests/bugs that you need for the web extension as blocking this bug? I realise the official LastPass policy is to not support non-release versions of browsers, however if you're missing an API and haven't advocated for its addition ASAP you may end up a bit stuck when Firefox 57 hits beta/release.

Also, it would be great if the build URL for any work in progress web extension version was posted here, so (a) developers using Nightly can still use LastPass in the meantime, (b) we can give early feedback / real-world test coverage.

Many thanks!

(I've also added the whiteboard tag so this bug appears against the LastPass entry on https://arewewebextensionsyet.com/ , and bumped the priority since this addon is in the "Most widely adopted" category)

Comment 14

[James Gilliland]

I contacted them through support and got what felt like a generic "we're aware and will get it done before release" response. Since 4.x was suppose to be a WebExtensions port I'm not entirely sure what that means or when we'll see it though. Agree'd a WIP dev version would be much appreciated for all the reasons stated.

Comment 15

[rachael.stockton]

Rachael from LastPass. Sorry for the frustration. We are working on this, but have no ETZ we can share at the moment.  We will update you as soon as we have more information.

Comment 17

[Hal Wine [:hwine] use NI!]

[Tracking Requested - why for this release]:

Looks like we may need some additional engagement here to encourage LastPass to move forward to having a trial version available for testing to folks using 57.

A number of mozillians use the LastPass service (we have the enterprise license), and would now need to choose between helping support the 57 release, and continue to use LastPass.

Comment 18

[Andy McKay]

It's been requested that for firefox 57, the tracking flag is used for bugs or code changes in Firefox. This isn't the case with this bug. 

Lastpass has been in contact with the mozilla outreach team and we've been working with them on it. So setting this flag doesn't add anything, just confuses things for release management. For that reason I'm taking it off.

Comment 19

[Andy McKay]

Was told that setting it to -- wouldn't clear it off the dashboards, setting it to unaffected as the least worst option.

Comment 20

[Graham Perrin]

> … need to choose between helping support the 57 release, and continue to use LastPass.

In theory: in the absence of the add-on, you should be able to use the bookmarklets. 

In practice: I can't use the bookmarklets with e.g. GitHub or Bugzilla@Mozilla on Firefox 55.0.3, QupZilla or Web. I'll raise that issue with LastPass.

Comment 21

[nyuszika7h]

(In reply to Graham Perrin from comment #20)
> In practice: I can't use the bookmarklets with e.g. GitHub or
> Bugzilla@Mozilla on Firefox 55.0.3, QupZilla or Web. I'll raise that issue
> with LastPass.

My guess is that's due to the sites' Content Security Policy blocking external scripts, including bookmarklets.

Comment 22

[Graham Perrin]

I had the same guess; <https://twitter.com/grahamperrin/status/908183020674351104> re: CSP

Comment 23

[Dave Miller [:justdave]]

Because I was told to try it, I went ahead and let me Developer Edition update to 57 this afternoon, on the premise that I could set the about:config flag to re-enable legacy extensions temporarily.  However, even with this enabled, LastPass does not work in 57 (several other legacy extensions do, so I know the flag worked in general).  I get no UI for Lastpass anywhere in the browser that I can find.  So I'm now left with a choice of switching to the Firefox Release version and not being helpful to our testing efforts or switching to some other password manager that actually supports the new Firefox.  Not a fun tradeoff.

Comment 25

[Dave Miller [:justdave]]

(In reply to captainhook from comment #24)
> You can uninstall version 57 and install 56.0b12.

I said that in the paragraph you just quoted (release version will be 56 shortly).

Comment 26

[campbell]

T minus 6 weeks until FF57 hits "stable", and not even a development version from LastPass. Are they waiting to test it on stable?

Good news: developers have all had a solid couple of months to try out all of LastPass' competitors, right at a time when we're feeling the sting of depending on a closed-source product. KeePass and Pass (webextension based) plugins have seen a nice boost of development.

Comment 27

[Paul Bone [:pbone]]

(In reply to campbell from comment #26)
> T minus 6 weeks until FF57 hits "stable", and not even a development version
> from LastPass. Are they waiting to test it on stable?
> 
> Good news: developers have all had a solid couple of months to try out all
> of LastPass' competitors, right at a time when we're feeling the sting of
> depending on a closed-source product. KeePass and Pass (webextension based)
> plugins have seen a nice boost of development.

Indeed.  FWIW I am testing bitwarden.  Nicer UI than lastpass too and open source so I think I'm staying.  I havn't tested the Aodroid app yet though.

Comment 28

[Ed Morley [:emorley]]

The current situation is pretty frustrating - either LastPass have been working on a web extension version but chosen not to share it (which is just asking for issues due to lack of real world testing), or else even worse haven't even gotten to the point of an MVP. Plus even before the web extension situation, there have been months of subtle breakage on and off with Nightly/Aurora/Beta. If Bitwarden can keep up with pre-release channels with its smaller revenue stream, then LastPass have no excuse.

Does anyone know who at Mozilla negotiated the Mozilla employees Enterprise plan? It would be great to see if we can leverage any contacts we have through that to try and make some progress (or alternatively advocating to them for us using eg Bitwarden for out next enterprise contract).

Comment 29

[Gordon P. Hemsley [:GPHemsley]]

(In reply to Dave Miller [:justdave] ([e-mail]) from comment #23)
> Because I was told to try it, I went ahead and let me Developer Edition
> update to 57 this afternoon, on the premise that I could set the
> about:config flag to re-enable legacy extensions temporarily.  However, even
> with this enabled, LastPass does not work in 57 (several other legacy
> extensions do, so I know the flag worked in general).  I get no UI for
> Lastpass anywhere in the browser that I can find.  So I'm now left with a
> choice of switching to the Firefox Release version and not being helpful to
> our testing efforts or switching to some other password manager that
> actually supports the new Firefox.  Not a fun tradeoff.

WebExtension-compatible extension aside, has anyone looked into why it broke even with extensions.legacy.enabled turned on? (Is this related to bug 1402325?)

Comment 30

[Andrei Petcu]

The Chrome extension used to work some time ago in Firefox. I kept building new versions but at some point it stopped working so I guess they added Chrome-only APIs.

Also Bitwarden works fine on Android Firefox :D

Comment 31

[campbell]

Tried out bitwarden... Not only do the extensions work, but the UI is better AND it's open source. Switching my family and business over this week.

Who would be the appropriate person to talk with at Mozilla about this? Seems like the organization should consider an Enterprise plan.

Comment 32

[Tristan Weir [:weir] -- use NEEDINFO for response]

(In reply to campbell from comment #31)
> Who would be the appropriate person to talk with at Mozilla about this?
> Seems like the organization should consider an Enterprise plan.

Mozilla Enterprise Information Security is responsible for password manager policy. We've looked casually at BitWarden, but I'll see if we can do a more formal evaluation.

Comment 33

[davidhollegien]

Instead of talking about a replacement for LastPass, (which may be feasible for Mozilla itself, but not for a lot of other companies using Firefox + LastPass combo).

I would like to see an update to this: "Lastpass has been in contact with the mozilla outreach team and we've been working with them on it."

Is there any progress/update on this? And related: why doesn't re-enabling legacy add-ons in the about:config make LastPass work again?

Comment 34

[Valentin Gosu [:valentin] (he/him)]

(In reply to davidhollegien from comment #33)
> Is there any progress/update on this? And related: why doesn't re-enabling
> legacy add-ons in the about:config make LastPass work again?

Since support for legacy addons in Firefox 57 has been dropped, a lot of changes have been made - APIs have been changed or even removed - that may break legacy addons. While re-enabling them will allow the old LastPass to run, it doesn't mean the addon will work properly.

Comment 35

[Andy McKay]

(In reply to davidhollegien from comment #33)
> I would like to see an update to this: "Lastpass has been in contact with
> the mozilla outreach team and we've been working with them on it."

We've been speaking to them quite a lot, but we'd rather let them tell everyone when they are ready. It's a big complicated extension and it's a part of their core business. I know its frustrating but as far as we can tell (talking from the add-ons team here) there is nothing blocking LastPass.

> Is there any progress/update on this? And related: why doesn't re-enabling legacy add-ons in the about:config make LastPass work again?

In Nightly? That will depend upon the Lastpass API. On Beta or Release the flag doesn't actually do anything. Please see https://wiki.mozilla.org/Add-ons/Firefox57

Comment 36

[Ed Morley [:emorley]]

(In reply to Andy McKay [:andym] from comment #35)
> It's a big complicated extension and it's a part of their core business.

Which is precisely why (a) they should realise that ironing out issues with alpha/beta versions made available to us is essential, (b) this needed to have been completed on an earlier timeframe to give a chance for said alpha/beta testing.

Comment 37

[Alistair]

For anyone still interested it seems LastPass has released a beta: https://blog.lastpass.com/2017/10/lastpass-beta-firefox-57.html

Comment 38

[Andrei Petcu]

I guess we can close this since Lastpass has a WebExtension in beta.

Comment 39

[George D]

Thanks to [:pbone] for pointing me to Bitwarden.  I didn't want to wait until the last minute to see if LastPass was going to surprise us with a WebExtension release, so I tried it out.  And now that I'm using it, I prefer it to LastPass.  I also don't need to pay to use it on my mobile devices.

Comment 40

[Zach Psyche]

(In reply to andrei from comment #38)
> I guess we can close this since Lastpass has a WebExtension in beta.

Said WebExtension is still in beta tho.

Comment 41

[Graham Perrin]

For reference only: 

<https://discourse.mozilla.org/t/-/19745/4?u=grahamperrin>

> LastPass: Free Password Manager 4.1.80.2beta installed, disappeared, worked around by a quit from Firefox 56.x.
> 
> LastPass Premium support ticket:
> 
> - 6308242

tl;dr I realised the absence of the button after I found fields not auto-filled, at a page where LastPass should have been effective.

Comment 42

[u603259]

57.0b12 blocks the latest extension version from showing the pop-up menu when clicking the extension's icon. Not sure why, but one can still login to the extension by right clicking and choosing the 'Lastpass' option in the context menu.

Comment 43

[Ed Morley [:emorley]]

So for anyone who tried the beta from comment 37 (v4.1.80.2beta) - it looks like it isn't (yet?) auto-updating to the newer version they've released on addons.mozilla.org (which is v4.2.1.21):
https://addons.mozilla.org/en-GB/firefox/addon/lastpass-password-manager/

In addition, the release version download link on their website still redirects to a version not compatible with Firefox 57:

$ curl -sSI https://lastpass.com/lastpassffx/xpi.php | grep -i location
location: https://addons.mozilla.org/firefox/downloads/file/748623/lastpass_password_manager-4.2.0.8a-an+fx.xpi?src=version-history

As such, I'd recommend manually installing from https://addons.mozilla.org/en-GB/firefox/addon/lastpass-password-manager/ to get on the latest release.

(Also for anyone else who like me is tired of the ongoing issues, I found out this week that it's possible to do an export from LastPass and pretty much seamlessly import into the open source https://bitwarden.com)

Comment 44

[Graham Perrin]

Modal authentication dialogues
==============================

1408110 - Deal with tabs that force a modal
https://bugzilla.mozilla.org/show_bug.cgi?id=1408110

Does 1408110 prevent extensions such as LastPass from working with modal authentication dialogues? 


Firefox ESR 52.5.0
------------------

<https://discourse.mozilla.org/t/-/19745/8?u=grahamperrin> with reference to 
LastPass premium support ticket # 6529225 where it's confirmed that 
2017-11-09 release 4.2.1.21 does not work as expected. 


Firefox Quantum (57.0)
----------------------

Screenshot <https://ibb.co/mDDFOG> referred from 57-specific 
<https://forums.lastpass.com/viewtopic.php?f=12&t=279765#p939405> (2017-11-14)

Comment 45

[Andy McKay]

At this point Lastpass is a WebExtension on AMO. 

If there are any bugs or issues, I suggest filing them with Lastpass or if its a Firefox bug, creating a seperate Firefox bug. Thank you everyone for your help.