1567423 - about:logins should allow searching by password

Status: VERIFIED FIXED

(Firefox :: about:logins, defect, P3)

Description

[Serge]

Attachment: PM2.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0

Steps to reproduce:

Open Lockwise and compare sorting capabilities.
Lockwise - Sort by:

• Name (aka Site),
• Last Updated,
• Last Change
• Filter (accepts useName and site)

Regular Password manager - Sort by:

• Site
• UserName
• Password (visible)
• Last Changed
  Sorting options of Lockwise are limited when compared to regular password manager.

Actual results:

Let's assume there is a task to delete/modify a range of credentials with the same password and specific userName

In regular Password manager this can be done by sorting by password (after clicking Show Password button). Later user can visually identify what Login-Pass pair needs to be deleted/modified and proceed with the change.
Please note that typical change in general can be done by single/doubleClick

Lockwise doesn't have any sorting/filtering options by Password.
To complete the same with the least effort task user needs to input userName into top filter.
Later he will be forced to visually inspect each entry:

• enter it.
• click on unhide password button
• visually identify password
• proceed with the change if needed

This is a severe UI/UX downgrade compared to the old method.

Expected results:

I believe the current behavior of Lockwise can be improved to fulfill the gaps with the help of the followings:

• allow to search/filter by actual password (at minimum)
• add option to globally show passwords that are assigned to the username in the sidebar.

Comment 1

[Jan Alexander Steffens [:heftig]]

Sorting and filtering by passwords in the old login manager has helped me move away from password reuse.

Comment 2

[Serge]

Hi, are there any updates?

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:MattN, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Sandy Sage]

For the initial Lockwise management experience, which replaces the previous Firefox login manager, we opted to prioritize sort/filter options by the known findability needs.

When it comes to identifying password reuse, we have plans in place to make that more visible AND actionable. This includes tools to understand the problems with password reuse coupled with the ability to change that password on each domain, which is where someone would need to make a password change. Sort/filter by password would be a stop-gap approach that doesn't entirely encompass this use case.

I'm assigning this issue a P3 given our aim to provide a more holistic approach for finding and updating recycled passwords.

We expect to learn from this first iteration of Lockwise in the browser and expect that revisions will be needed. Based on our findings we may change the priority of this request.

Comment 5

[Serge]

Thank you for the update.
However if you present Lockwise as an replacement for the password manager shouldn't the new tool improve usability when compared to the old one?
Could you provide more details on the mentioned solution?
What will happent first, integration of the mentioned solution or replacement of password manager with Lockwise?

Comment 6

[Serge]

Hi there,
Are there any updates on this matter?

Comment 7

[Jared Wein [:jaws] (please needinfo? me)]

We will be adding the ability to search by password as long as Master Password is not enabled.

Comment 8

[Jared Wein [:jaws] (please needinfo? me)]

We will be adding the ability to search by password as long as Master Password is not enabled.

Comment 10

[vtol]

What is the point of constraining the search to only records where the master password is not enabled? The feature worked with master password enabled in the legacy password manager and it would be expected that Lockwise replicates such.

Else, you are putting the user between a rock and hard place, enable master password but not password search or disable master password and be able to search/filter by password.

Comment 11

[Jared Wein [:jaws] (please needinfo? me)]

If we want to include something for Firefox 70, we're constrained by the types of modifications we can make the UI at this point. The old UI had a way of displaying all the passwords from one singular event of clicking on the "Show Passwords" button. When the button is clicked we show the Master Password prompt, and then can reveal all passwords if it is provided.

What I proposed in comment 8 would allow for searching passwords, but that would happen on each keystroke. We don't want to display the master password prompt on each keystroke. It's not intuitive to show the master password prompt when searching, so for Firefox 70 the simplest thing to do is to only enable password searching when Master Password is not enabled.

We can provide a better solution in a future release.

Comment 12

[vtol]

Thanks for the explanation. Suppose a workaround -> disable master pw -> seach/filter pw -> enable master pw.

Opening another bug then for that better solution in a future release?

Comment 13

[Jared Wein [:jaws] (please needinfo? me)]

Attachment: Bug 1567423 - Allow for searching passwords in about:logins when MP is disabled. r?MattN

Comment 14

[Jared Wein [:jaws] (please needinfo? me)]

Attachment: Bug 1567423 - Combine all synchronous messages sent at startup of about:logins. r?MattN

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cd9efd25e7ce
Combine all synchronous messages sent at startup of about:logins. r=MattN
https://hg.mozilla.org/integration/autoland/rev/905f54445001
Allow for searching passwords in about:logins when MP is disabled. r=MattN

Comment 16

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/cd9efd25e7ce
https://hg.mozilla.org/mozilla-central/rev/905f54445001

Comment 17

[Simona Rosu [:srosu], Ecosystem QA, PTO - NI to: [e-mail]]

I have verified this issue on the latest Nightly 71.0a1 (Build ID: 20190918100042) (64-bit) on Windows 10, MacOS 10.14 and Ubuntu 16.04 x64.

• You can successfully search by passwords if the Master Password is not set.
• No results are returned if searching by passwords if a Master Password is set.

Comment 18

[Jared Wein [:jaws] (please needinfo? me)]

https://hg.mozilla.org/releases/mozilla-beta/rev/23b2c24e9c80
https://hg.mozilla.org/releases/mozilla-beta/rev/d625054db0cd

Comment 19

[Simona Rosu [:srosu], Ecosystem QA, PTO - NI to: [e-mail]]

I have verified this issue on the Firefox Beta 70.0b9 (Build ID: 20190923154733) (64-bit) on Windows 10, MacOS 10.14 and Ubuntu 18.04 x64.

• You can successfully search by passwords if the Master Password is not set.
• No results are returned if searching by passwords if a Master Password is set.