1313699 - Munged username filled on fidelity.com/401k.com

Status: RESOLVED FIXED

(Toolkit :: Password Manager: Site Compatibility, defect, P3)

Description

[Dan Jacobson]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:50.0) Gecko/20100101 Firefox/50.0
Build ID: 20160925011120

Steps to reproduce:

Tried to login to https://www.fidelity.com/ using what was prefilled.


Actual results:

It said my credentials were wrong.


Expected results:

Be able to login.

Sites like Fidelity are probably using a cookie so that when you visit them later, your username gets pre-filled in. However it is pre-filled in by them with stars **** at the front.

The user then types his password, which is remembered by browsers in the combination ****blabla / password.

A future third login begins the never ending frustration: Both fields are pre-filled in, but login somehow fails, as probably the stars are being sent to the server instead of the full user name, as now Firefox is filling out both fields or something,

The only way for the user to actually login now is for him to retype the his user name.

Comment 1

[Dan Jacobson]

I also opened https://bugs.chromium.org/p/chromium/issues/detail?id=660396 but I selected "security" which caused the bug to be unviewable to you. Sorry.

Comment 2

[Dan Jacobson]

OK https://bugs.chromium.org/p/chromium/issues/detail?id=660396 is now viewable.

Comment 3

[YF (Yang)]

I see the SSN (username) parameter will not be send if user was not clicked the username box, with Devtools - Network. This is a website issue.

Comment 4

[Thomas Wisniewski]

We just received another report about this on webcompat.com. Regardless of it being site error, it seems that something in Chrome 55.0.2883.87 corrected the issue on their end. Shall we find out what that was and adopt something similar?

Comment 5

[Matthew N. [:MattN]]

Password manager isn't being actively worked on at the moment so it wouldn't be a high priority to get that info.

Comment 6

[Matthew N. [:MattN]]

We should no longer save the asterisk since bug 1427624 on Nightly, instead we will leave the username field blank for the user to manually fill (the password can be filled via autocomplete still without the username).

Can you confirm that this working for you in Nightly? https://nightly.mozilla.org/

Comment 7

[Dan Jacobson]

Well I use debian sid so am behind (66), so I will trust you.

Comment 8

[Thomas Wisniewski [:twisniewski]]

I don't personally have an account, so I can't be sure.