286857 - Wrong password field autofilled at https://finanzonline.bmf.gv.at/ due to 2 type=password

Status: NEW

(Toolkit :: Password Manager: Site Compatibility, defect, P3)

Description

[Boris 'pi' Piwinger]

Using Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050217 on
https://finanzonline.bmf.gv.at/ the password is not saved (no question appearing).

I have set user_pref("wallet.crypto.autocompleteoverride", true); and
double-checked that the site is not listed under pages not to be saved.

pi

Comment 1

[Daniel Veditz [:dveditz]]

There is no autocomplete="off" attribute, there's nothing to override by the pref.

Interesting that the Firefox password manager also does not capture the password
on this page even though it's a separate implementation. I suspect the two
password fields are confusing us into thinking it's a "new password" page (where
you have to type the same password twice), but since they don't match we ignore
it as a likely failure.  Just a guess at this point.

Comment 2

[Boris 'pi' Piwinger]

That's interesting. When was autocomplete removed? It used to help against sites
which are IE-protected (using some attribute to prevent passwords from being
saved by the form manager of IE). It was the solution for yahoo.com where we
have some bugs about.

pi

Comment 3

[Daniel Veditz [:dveditz]]

Last I saw the override pref still worked in the suite (don't think it ever did
in Firefox). I meant the page you linked did not appear to use that attribute,
so there was nothing in this case to override. It's broken for some other reason
(or, if there is an autocomplete="off" that I missed please let me know so I
don't head off in the wrong direction).

Comment 4

[Boris 'pi' Piwinger]

OK, I just was not sure there could be a hidden trick on their side or our 
overwrite would also capture other things and force saving.

So someone should find out why it fails. I have no clue how to do this.

pi

Comment 5

[Boris 'pi' Piwinger]

I was just about to file this bug, obviously I did a year ago.

pi

Comment 6

[Boris 'pi' Piwinger]

Problem still exists in:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2pre) Gecko/20070111 SeaMonkey/1.1

The problem is also true if you switch Javascript off.

pi

Comment 7

[Greg K.]

For what it's worth, this does work using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.1) Gecko/2008070206 Firefox/3.0.1. It does only store one of the two password fields, though. Is there a bug about saving multiple password values?

Comment 8

[Serge Gautherie (:sgautherie)]

(In reply to comment #0)
> I have set user_pref("wallet.crypto.autocompleteoverride", true); and

Removing reference to this preference from bug summary, as the site does not use this attribute.
(Fwiw, it would otherwise depend on bug 425145 now.)

Ftr, page source is +/- like
{{
<LABEL for="TID"><b>Teilnehmer-Identifikation:</b></LABEL>
<FORM action='/fon/login?'  name="LoginForm" method="post"> 
<INPUT size="20" type="text" maxlength="12" name="TID" class="inputArea" id="TID" value="">
<LABEL for="BENID"><b>Benutzer-Identifikation:</b></LABEL>
<INPUT size="20" type="password" maxlength="12" name="BENID" id="BENID"	value="">
<LABEL for="PIN"><b>PIN:</b></LABEL>
<INPUT size="20" type="password" maxlength="12" name="PIN" id="PIN" value="">
}}


(In reply to comment #7)
> this does work using Mozilla/5.0 (Macintosh; U; Intel Mac
> OS X 10.5; en-US; rv:1.9.0.1) Gecko/2008070206 Firefox/3.0.1. It does only
> store one of the two password fields, though.

Could you check Firefox 3.1b2 and a recent (after bug 433316 & co) SeaMonkey v2.0a3pre ?

Comment 9

[Boris 'pi' Piwinger]

With Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b3pre) Gecko/20090223 SeaMonkey/2.0a3 the problem changed. Something is saved, but even worse, wrong data!

The first (Teilnehmer-Identifikation) is saved correctly, the second (Benutzer-Identifikation) is saved, but incorrectly namely with the content of the third field (PIN) which in turn is left blank.

I could understand (still a bug) that the third field is not saved, but I cannot understand how wrong data is saved. That looks like bug 486829 (when converting the profile wrong data was saved) or bug 474846 comment 16.

pi

Comment 10

[Robert Kaiser]

INVALID, as we are supposed to follow the instruction of a website to never save data.

Comment 11

[Boris 'pi' Piwinger]

I cannot see the page does use such an instruction.

Comment 12

[Robert Kaiser]

If this still happens then, it's a toolkit bug, though.

Comment 13

[Kevin Brosnan [:kbrosnan]]

Sites with more than a user name and password field to remember is 222589.

Comment 14

[Boris 'pi' Piwinger]

Actually, as I reported, it does save something but fills something else. This is different from bug 222589.

Comment 15

[Matthew N. [:MattN]]

I can confirm that the password in the second password field is autofilled into the first password field after choosing the username from autocomplete.

Comment 16

[Matthew N. [:MattN]]

Attachment: WIP - Example recipe (not sure which field to use for the username)

Hi Boris, we recently made improvements to password manager which can help with this bug but we will still only be able to save one "username" and one "password" and we will properly fill them back into the correct fields but I am not sure which field I should save as the "username" field: should it be "Teilnehmer-Identifikation" or "Benutzer-Identifikation"?

Thanks

Comment 17

[Boris 'pi' Piwinger]

I would put the username in Teilnehmer and the password in PIN.

Comment 18

[Matthew N. [:MattN]]

Just to double-check:
* What do the 3 fields represent? And which of the first two are associated with an individual?
* Are all three field values chosen by the account holder or are some assigned?
* Suppose a Firefox profile shared by a household has accounts for multiple members of the household on the same bank, could either of Teilnehmer or Benutzer be the same?

Thanks, I'm not familiar with this system and want to make sure the interaction will make sense in various cases.

Comment 19

[Boris 'pi' Piwinger]

Honestly, this form is a bit stupid. The first two are both referring to the user. 

If I recall correctly, one is assigned, the second not sure, this is not something I would naturally choose.

This is a government tax filing system.

Comment 20

[Robert Kaiser]

Yes, it's the government system for all kinds of tax-related business. "Teilnehmer" is a fixed string for the user which will never change. Both "Benutzer-ID" and and "PIN" (Password) can be changed by the user through some means, the latter easily, the former harder to do.

For access to tax records/administration for a company, for example, the company account has a specific "Teilnehmer" ID but different people who can admin things there all can have different "Benutzer-ID"/"PIN" combinations.

Comment 21

[Robert Kaiser]

Oh, and I think even normal people can create additional "Benutzer-ID"/"PIN" combinations with additional specific permissions so that other persons can do certain actions related to their taxes without full access to their account.