1745712 - Password manager updates wrong password signing-on to banking.westpac.com.au

Status: UNCONFIRMED

(Toolkit :: Password Manager: Site Compatibility, defect, P3)

Description

[oneofthedamons]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0

Steps to reproduce:

Used Password Manager to remember Customer ID and correct password when signing-in to banking.westpac.com.au, then signed-out and attempted to sign-in again.

Actual results:

Even when the password entered matches the (correct) password previously stored in Password Manager, Firefox still asks to "Update" the password. Accepting the offer to update the password replaces the correct password with an incorrect, seemingly random password in about:logins.

Expected results:

The password manager should not offer to "update" the password if it matches that in about:logins. I have no idea from where the replacement password is coming in this case — it certainly is not user input.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::about:logins' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Sergey Galich [:serg]]

:oneofthedamons thanks for reporting this bug.

I've took a quick look and this site uses some hidden fields for username/password. Moving to Site compatibility.

Comment 3

[oneofthedamons]

Strangely I can't replicate this issue on Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0.

Comment 4

[oneofthedamons]

Sorry should have added Version string 96.0b4

Comment 5

[Dimi Lee [ooo 16.04 - 21.04］]

(In reply to oneofthedamons from comment #4)

Sorry should have added Version string 96.0b4

Hi oneofthedamons,
Could you share what the Firefox version you were using when you encountered this issue?

Comment 6

[oneofthedamons]

96.0b4 on MacOS. It's strange that I can't replicate it on 96.0b4 on Windows 10, but I've tried it in Troubleshooting Mode and a Private Window to eliminate an extension or state causing the issue on MacOS, but it still occurs…

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:sgalich, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 8

[Dimi Lee [ooo 16.04 - 21.04］]

Hi oneofthedamons:
I am not able to reproduce this issue on MacOS 12.0.1
Could you help collect debugging logs for this issue?
Here is how to do that, there is also a video guide: https://wiki.mozilla.org/Toolkit:Password_Manager/Debugging
Really appreciate for your help!

Comment 9

[oneofthedamons]

Attachment: console-export-2022-1-7_19-42-55.txt

Done! I wasn't comfortable with the username being included in the debug logs so I have redacted each occurrence with the text "REDACTED" — I hope that's ok?

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:sgalich, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 11

[Dimi Lee [ooo 16.04 - 21.04］]

Hi oneofthedamons,
Thank you for dumping the log! and yes, replace the username is not a problem at all :)
From the log, Firefox picked the correct password field to check whether we should show the doorhanger. And it does think the password is different than the saved one, that's weird.
So I would like to confirm my understanding:

1. When you go to the page, the password we autofilled or autocomplete is correct
2. After you click "Sign In", the password in the doorhanger is the WRONG one.

If the above is true, could you help open the Developer Tool Console and type document.querySelector("input[name=password").value (this should print the value of the password field).
And let me know whether the value printed is the correct password or the wrong password coming from no where (of course, don't share the password with me, just which case it is).

Also, I saw you reproduce this bug in private browsing mode. Could you also do a test whether this can be reproduced in non-private browsing mode? Thank you!

Comment 12

[oneofthedamons]

Attachment: Screen Shot 2022-01-07 at 10.24.24 pm.png

When I input the correct password into the password field, and then press the "Update" button in "Update login for westpac.com.au?" (see attachment), the password I have entered is not the password that is updated in Password Manager. It's a different, seemingly random, password each time.

If I manually edit the password in about:logins so that it is the correct password, then upon reloading banking.westpac.com.au it autofills correctly, the correct password is returned by document.querySelector("input[name=password").value in the Developer Tool console and the site allows me to login. However the same behaviour then occurs: Firefox offers to update the password (even though it is the same password as I manually entered in about:logins), and upon allowing Password Manager to update the password it replaces the correct password with an incorrect password. When I reload banking.westpac.com.au the password autofills with the (now incorrect) value in about:logins which is the same value returned by document.querySelector("input[name=password").value in the Developer Tool console.

I hope that makes sense?

The seemingly random, replacement password is always of the same form; Westpac has ridiculous password requirements that indicate their systems are stuck in c.1995 — "exactly 6 characters including at least 1 number and 1 letter". The random password is always of this form, which may be significant.

I confirm this happens in non-private browsing mode too.

Comment 13

[Dimi Lee [ooo 16.04 - 21.04］]

Hi oneofthedamons, really appreciate for the detailed information!
I know I've asked a lot, but could you help check if this issue is reproduced in trobuleshooting mode[1]? Thanks!

[1] https://support.mozilla.org/en-US/kb/diagnose-firefox-issues-using-troubleshoot-mode

Comment 14

[oneofthedamons]

Yep as per Comment 6 I've already tried in Troubleshooting Mode, unless you wanted me to do the specific steps you outlined in Comment 11 in Troubleshooting Mode?

Comment 15

[Dimi Lee [ooo 16.04 - 21.04］]

(In reply to oneofthedamons from comment #14)

Yep as per Comment 6 I've already tried in Troubleshooting Mode, unless you wanted me to do the specific steps you outlined in Comment 11 in Troubleshooting Mode?

ah, you're right, I forgot that. No, you don't have to test again.

Comment 16

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:sgalich, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 17

[Dimi Lee [ooo 16.04 - 21.04］]

Hi oneofthedamons,
Could you help test if this issue is reproduced in Safari and Chrome, really appreciate for your help!

Comment 18

[oneofthedamons]

I can't replicate the issue on either Edge or Safari.

As part of the process I entirely deleted the entry for banking.westpac.com.au in the Firefox about:logins, but the issue still occurs when it is recreated.

My position with these things is I assume it's usually something I've done (particularly with my very old Firefox profile!) so I tried downloading Nightly, and not connecting it via Firefox Sync. Replicated the issue on this non-customised Nightly installation.

Comment 19

[Dimi Lee [ooo 16.04 - 21.04］]

Hi oneofthedamons,
Could you help set the pref signon.formlessCapture.enabled to false and try again? Thanks!

Comment 20

[oneofthedamons]

That resolved the issue!

Comment 21

[alexifti1337]

It seems like you're experiencing an issue with the password manager in Firefox when signing in to banking.westpac.com.au. Here are some steps you can take to troubleshoot and potentially resolve the issue (I already faced the same problem on https://www.treasuryprime.com/):

Check Stored Passwords:
Open Firefox and go to about:logins in the address bar.
Check if the correct login information for banking.westpac.com.au is stored. If not, you might need to manually add it or update it with the correct information.

Check Autofill Settings:
Go to Firefox Preferences or Options.
Navigate to the Privacy & Security section.
Check the Autofill settings to ensure that the password manager is enabled and set up correctly.

Clear Cookies and Cache:
Sometimes, stored cookies or cached data may cause issues. Try clearing your browser cookies and cache.
Go to Firefox Preferences or Options.
Navigate to the Privacy & Security section.
Scroll down to the Cookies and Site Data section and click on "Clear Data."

Update Firefox:
Ensure that you are using the latest version of Firefox. Outdated browser versions may have bugs that have been fixed in newer releases.

Disable Add-ons:
Temporarily disable any third-party browser extensions or add-ons that might interfere with the password manager.

Test in a New Profile:
Create a new Firefox profile and test if the issue persists in the new profile. This can help determine if the problem is specific to your current profile.

Remember to back up your important data before making significant changes to your browser settings.

Comment 22

[alexkhan13337]

It seems like you're encountering an issue with Firefox's Password Manager when signing in to banking.westpac.com.au. To address this, you may want to try the following steps: Answer Credit https://openingtoclosehours.com/

Clear Saved Passwords:
Go to Firefox Preferences > Privacy & Security > Logins and Passwords. From there, you can view and manage saved passwords. Clear any saved passwords related to banking.westpac.com.au and try signing in again, allowing Firefox to save the correct login information.

Update Firefox:
Ensure that you are using the latest version of Firefox. Outdated browser versions may have compatibility issues. You can check for updates in Firefox Preferences > General > Firefox Updates.

Check Password Manager Settings:
Review your Password Manager settings in Firefox Preferences to ensure there are no conflicting configurations that might be causing this behavior.

Contact Firefox Support:
If the issue persists, you might want to reach out to Mozilla Firefox support for more specific assistance. They can provide guidance or investigate if there's a bug causing this behavior.

Remember to exercise caution when managing passwords and ensure that your login credentials are securely stored.