1565409 - Auto-save used generated passwords as long as there isn't already a login with an empty username for the site.

Status: VERIFIED FIXED

(Toolkit :: Password Manager, enhancement, P1)

Description

[Matthew N. [:MattN]]

Bug 1548857 only implemented auto-saving of filled generated passwords if there were no logins saved for the site (to not overwrite existing ones before they're no longer needed) but to improve consistency and reduce data loss we should save whenever their isn't already a login with an empty username.

Comment 1

[Matthew N. [:MattN]]

Attachment: Bug 1565409 - Part 2: Auto-save used generated passwords as long as there isn't already a login with an empty username for the site. r?MattN

Previously we only auto-saved if there were no logins for the site.

Comment 2

[Matthew N. [:MattN]]

I had a WIP patch the other day so I attached it here but please feel free to commandeer the Phab revision.

Comment 3

[Sam Foster [:sfoster] (he/him)]

Attachment: Bug 1565409 - Part 1: Refactor onGeneratedPasswordFilled unit test. r?MattN

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/46f1d5ddd453
Part 1: Refactor onGeneratedPasswordFilled unit test. r=MattN
https://hg.mozilla.org/integration/autoland/rev/9234c94b4b9a
Part 2: Auto-save used generated passwords as long as there isn't already a login with an empty username for the site. r=MattN

Comment 5

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/46f1d5ddd453
https://hg.mozilla.org/mozilla-central/rev/9234c94b4b9a

Comment 6

[Daniel Bodea [:danibodea]]

Out of the top 15 websites, only Google, Yahoo and Pinterest appear to have password fields with the autocomplete attribute having the value "new-password" so I will test these 3 for the case when the password manager drop-down contains a generated password option:

This implementation appears to be working correctly in the case of Google and Yahoo. When on these sites and the user changes the password with a generated one, in any of the 3 cases:

1. There is a saved login with both username and password for the site -> A new password is automatically saved without a username.
   A dismissed door hanger with the message "Password saved!" is displayed and a blue key-like icon is displayed.
2. There is a saved login with only a password for the site -> A new password is NOT saved automatically.
   A dismissed door hanger is displayed and a grey key-like icon, but no message (except for Pinterest, where no grey-key like icon is seen)
3. There is no saved login for this site -> A new password is automatically saved without a username.
   A dismissed door hanger with the message "Password saved!" is displayed and a blue key-like icon is displayed.

Out of the other top 15 sites, from the ones that do not have a password field with attribute autocomplete="new-password", I have chosen to use Facebook and Amazon. I will test the same 3 cases:

1. There is a saved login with both username and password for the site -> A new password is automatically saved without a username.
   A dismissed door hanger with the message "Password saved!" is displayed and a blue key-like icon is displayed.
2. There is a saved login with only a password for the site -> A new password is NOT saved automatically.
   A dismissed door hanger is displayed and a grey key-like icon, but no message.
3. There is no saved login for this site -> A new password is automatically saved without a username.
   A dismissed door hanger with the message "Password saved!" is displayed and a blue key-like icon is displayed.

A case that seems problematic is seen when changing the password of Pinterest while having a login saved with a blank username: bug 1570282.

In conclusion, I believe that this implementation bug should be considered verified. A new bug is logged for the edge case remaining.
Verified on Nightly v70.0a1 (2019-07-30) on Windows 10.

Comment 7

[Daniel Bodea [:danibodea]]

Attachment: logs for Pinterest changing password while having a login with a blank username