1691903 - [screwfix.com][Register][false-negative] Password Generation option is not displayed in the autocomplete dropdown

Status: RESOLVED WORKSFORME

(Toolkit :: Password Manager: Site Compatibility, defect, P3)

Description

[Timea Cernea [:tbabos][inactive]]

Attachment: Video of the issue

Affected Versions:

• Nigthly 87.0a1 (2021-02-09)
• Beta 86.0b7
• Release 85.0

Tested On:

• MacOS 10.15

Steps to Reproduce:

1. Go to screwfix.com register page: https://www.screwfix.com/registrationpage/
2. Pass through the email form and reach the 2nd page
3. Click on the first Password field
4. Click on the second password field

Expected:
Since we are on a register form, the password generation option should be offered in the autocomplete dropdown

Actual:
Password Generation is not offered in the autocomplete dropdown for the first Password field but is offered on the Retype Password field

Notes:

• Reproducible on Chrome? Yes, it doesn't appear for any of the fields there
• Field attribute:
  • New password field:
    <input type="password" name="Password" id="password" placeholder="Password" class="fm-input" required="" aria-required="true" data-alt-name=" your password" maxlength="20" autocomplete="off">
  • Retype Password field:
    <input type="password" name="retypePassword" id="retypePassword" placeholder="Re-type Password" class="fm-input" data-alt-name="Please re-enter your password" maxlength="20" autocomplete="off">
• Regression-range: not a regression, reproducible back to 80 when we started to display the password generation option in the autocomplete dropdown

Comment 1

[Tim Giles [:tgiles] | OOO Nov 25-29]

Fathom is giving a 99 score to the confirm password field, and only a 52 to the password field. This seems related to both 1691441 and 1691444. I'm still not sure why Fathom doesn't like this pattern, but we have a few more sites to add to the training data so hopefully we can solve this pattern.

Comment 2

[Dimi Lee [:dimi]]

Confirmed password fields matches the following rules:

elementAttrsMatchConfirm: coefficient(1.79710853099823)
hasConfirmPlaceholder: coefficient(2.120662212371826)
closestLabelMatchesConfirm: coefficient(2.188796281814575)
hasConfirmLabel: coefficient(1.9212454557418823)

while the "password" field doesn't match any rules.

Comment 3

[Dimi Lee [:dimi]]

Not sure if it is possible to use fathom to first learn a field is a confirm password field, and then use it to infer that the previous field is probably also a new password field.

Comment 4

[Timea Cernea [:tbabos][inactive]]

This is no longer reproducible on the latest Firefox Nightly 91.0a1 version, tested on MacOS.