180540 - [pwd-mngr] Satchel: Option to store username but not password in each website that uses usernames and passwords

Status: RESOLVED WORKSFORME

(Toolkit :: Password Manager, enhancement)

Description

[Ed Hume]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3a) Gecko/20021114 Phoenix/0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3a) Gecko/20021114 Phoenix/0.4

When storing a password, both Phoenix and Mozilla ask if the user wants to store
the form info. Neither browser asks if the user would like to store the username
only. 

When form manager is implemented in Phoenix, it would be nice to have that
option. For reasons, see below.

Reproducible: Always

Steps to Reproduce:
1. Log onto site requiring a username and password (e.g.--Bugzilla)
2. Enter username and password.
3.

Actual Results:  
Phoenix and Mozilla ask if the user would like to store the information.

Expected Results:  
Ask if the user would like to store all the information or just the username.

The username-only option would be useful especially when the username is an
email address. In these cases, the username is generally long, so it is a pain
to type. It is also easily known, so there is no security benefit to keeping it
unknown. The security benefit remains for not storing the password, however.

Thank you.

Comment 1

[Bryan]

Hi,
I think that is a good idea but security is an issue for some users expceially
in businesses who are testing this and using it as thier all time browser

Comment 2

[David P James]

I like this idea. Some websites already implement this through their use of
cookies (Yahoo! Mail and my bank's online site) but it would definitely be neat
if Phoenix supported it for all websites.

-->Changing summary to specify Satchel as object of the request
-->This request depends on bug 173565 (until Satchel replaces Password Manager
improvements to it are pointless)
-->Changing component to Autocomplete to match component of bug 173565
-->All OS
-->Confirming as New for developer review

Comment 3

[djk]

I think that the form autocomplete should automatically remember the username
(unless it has autocomplete="off"), and then ask to remember the associated
password or not.

Satchel doesn't prompt you whether to remember text input fields (username), but
the password manager still wants to remember the whole form.  Password Manager
should not do anything until a username is selected via satchel, then
automatically fill in the password if there's a match (and no
autocomplete="off", of course).

Comment 4

[David P James]

Taking QA. Sorry for the bugspam

Comment 5

[Mike Connor [:mconnor]]

Brian, since you forked password manager already, is this feasible?  Do we
really want this implemented?

Comment 6

[David P James]

Adding [pwd-mngr] to summary of Password Manager bugs to facilitate querying.
Sorry for the bugspam.

Comment 7

[Allen]

The bank I use (sparkasse) has modified its password handling and as a result
has completely messed up the password manager.  I suspect that the option to
disable saving of the password would make things a little less messy.  Maybe
this bug can be bumped a little in priority?

In summary:

Sparkasse has started generating a random name field in its password field:

<input type="password" name="mnjoA0i1gv" value="" size="16"
maxlength="5">&nbsp;&nbsp;<input type="image" style="cursor: hand;"
src="/blz/69051725/../../profil5/gifs/but_anmeldung.gif" name="Anmelden"
title="Anmelden" alt="Anmelden" border="0">

I have three accounts.  Right now, every time I go to the page, the popup to
select the account comes up, but when I select it, only the account and not the
password is entered.  Not great, but I can live with that.

The problem comes the next time go to the site.  I now have two entries for the
account.  Each time I go to the site, I get a new entry.

So now I have to disable password manager for the site.  It would be nice if I
didn't have to remember all my account numbers...

Allen

Comment 8

[Phil Ringnalda (:philor)]

*** Bug 269580 has been marked as a duplicate of this bug. ***

Comment 9

[Jaime Mitchell (use [e-mail] for email)]

*** Bug 294582 has been marked as a duplicate of this bug. ***

Comment 10

[David P James]

Mass edit: Changing QA to default QA Contact

Comment 11

[Justin Dolske [:Dolske]]

If the password manager is disabled, or set to never save logins for a site, the username field will not get any special treatment, and will be handled by the form manager just like any other text field.