348941 - (separate-page-username-password) Provide Capability to Handle Logins with User ID and Password on Separate Pages

Status: NEW

(Toolkit :: Password Manager, defect, P3)

Description

[David E. Ross]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060729 SeaMonkey/1.0.4 Mnenhy/0.7.4.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060729 SeaMonkey/1.0.4 Mnenhy/0.7.4.0

More and more financial institutions (including Bank of America and Vanguard Mutual Funds) are upgrading their Web sites so that logging-in to my account involves having my user ID on one Web page and my password on another.  Vanguard calls this a split login.  This is making the current Password Manager useless.  

For both Firefox and SeaMonkey, the Password Manager should be also upgraded to handle the upgraded, split logins.  

Reproducible: Always

Comment 1

[Michael Wu [:mwu]]

I thought financial institutions already disabled the password manager? At any rate, Firefox's password manager already has support for password only logins.

Comment 2

[Doug VerSteegh]

My query is for how the log in overrides usage on concurrent MySpace pages... not sure if this would apply in this specific bug search - but it was the only one that looked very similar to our issue at hand.

When my wife logs in to her MySpace account with the stored password feature, and then I open a new Firefox window and log in with my info (stored as well), if and when either one of us then opens a new tab or window subsequent to the originals - the open window then becomes the "property" so to speak of whomever was the first one to log in......

Example:  We play Game Applications on MySpace - namely Heroes and Mobster, so we usually have open one main profile page (home page) for updating info at MySpace, and then two more individual pages with each game operating on their own respective pages, and use the tabs to play different aspects of the games on the tabs. Now, if my wife was the first one to open a Firefox window and set up her gaming, once I log in and get my three windows opened up to play - here is the tricky part: When I open a new tabbed window on the game level - it automatically opens under her named pages instead - but only when they are tabbed open (or by default of the game itself - will open in a new tab based on links programmed into the games). If I am the first to open up and set up - then of course the reverse happens - every time she opens a tabbed extension - it becomes my screens instead. As long as either one of us stays on the specific "main" windowed page we logged in under - then there are no issues...  As this all stand s right now - I am unfortunately forced to open my set of gaming applications under IE, and really lose the speed and functionality of Firefox that we originally downloaded to our system to take advantage of......

In other words - IE runs so slowly now that I am continually getting my ass handed to me by other gamers while playing (waiting for refresh screens to open) - while my wife breezes thru attack after attack and just keeps advancing....

Thanks,    Doug VerSteegh

Comment 3

[David E. Ross]

Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20110511 SeaMonkey/2.1

For a long time now, this was not a problem.  I know for sure this was not a problem with SeaMonkey 2.0.14 as recently as 6 May 2011.  However, this problem re-appeared with SeaMonkey 2.1RC1.  

Given that a prior version of Password Manager was indeed working as requested in this bug report but the current version is not working that way now, I consider this a regression bug and not an RFE.  Changing the Importance from "enhancement".

Comment 4

[David E. Ross]

Note:  When I go to a Web site that uses a "split login" and I have previously (under SM 2.0.14 or an earlier version) saved the password, I get a request for my master password on the page where a password is to be entered.  I input the master password into the dialogue popup, but the login password is NOT inserted in the input area.

Comment 5

[David E. Ross]

This problem appears to be restricted to the following situation,
all of the following required for failure:
*  The Web site uses a split login.
*  The site blocks the saving of passwords.
*  Password Manager already had saved the necessary login password
before such saving was blocked.

In this situation, Password Manager recognizes that the necessary login
password has been saved, so it requests the Master Password.  Something
after that point is broken when Password Manager recognizes that the Web
site blocks the saving of passwords.

Comment 6

[RAY DAVISON]

(In reply to comment #3)
> Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20110511 SeaMonkey/2.1
> 
> For a long time now, this was not a problem.  I know for sure this was not a
> problem with SeaMonkey 2.0.14 as recently as 6 May 2011.  However, this
> problem re-appeared with SeaMonkey 2.1RC1.  
> 
> Given that a prior version of Password Manager was indeed working as
> requested in this bug report but the current version is not working that way
> now, I consider this a regression bug and not an RFE.  Changing the
> Importance from "enhancement".

I currently have SM 1.1.19, 2.0.14 and 2.1rc1.  1.1.19 works including split log-in.  The latter two do not.

Comment 7

[Stanimir Stamenkov]

(In reply to comment #1)
> I thought financial institutions already disabled the password manager?

You know, there are various ways to enable it, even just one time to remember the login details.

> At any rate, Firefox's password manager already has support for password 
> only logins.

It doesn't seem to support initializing the field of an username only page even when there's username and corresponding username field remembered for the given origin/host.

Comment 8

[David E. Ross]

One problem with the current design is that, with user IDs and passwords on separate Web pages, only one password can be applied to multiple login accounts.  There is no way to distinguish separate passwords for separate accounts.  

I would suggest that, when storing a password that is entered on a page without a user ID, Password Manager should request the user (in a popup dialogue) to provide an associated user ID.  The user ID would not even have to match the actual user ID; it would only have to identify the password in a user-oriented manner.

Comment 9

[David E. Ross]

To expand on my comment #8:  

Currently, when the user ID and password are entered on separate pages and Password Manager has stored the password, the user ID in the password database is blank.  My suggested fix would involve (1) storing the user-supplied associated ID (causing an entry in the database for each ID) and (2) using the existing pull-down selection list that is a capability for multiple accounts with the user ID and password both on the same Web page.  


Regarding comment #1:  

See bug 425145 comment 35.  As of today, 7,311 users have downloaded the Remember Passwords extension as a work-around for this bug.

Comment 10

[Chris Karlof [:ckarlof]]

Recipes could help with this.

Comment 12

[Chris Karlof [:ckarlof]]

Currently blocked by a technical and UX design, but we want to address it in Q1 2015.

Comment 13

[David E. Ross]

Use case:  

We have two different accounts at a credit union, each with a different user ID.  The credit union's Web site uses a split login.  The page where a password is input always has the same URI, no matter what user ID was previously input.  

If I try to setup separate passwords, Password Manager replaces the first input password with the second input password.  Thus, I cannot setup two passwords relative to the URI of the input-password Web page.  Even if I could input two passwords for the same input-password Web page, Password Manager would not given me the ability to distinguish them.  

Thus, I must use the same password for two different accounts at the same credit union.  This creates a risk of a security vulnerability since good security indicates I should have a distinct password for each account.

Comment 15

[Timea Cernea [:tbabos][inactive]]

QA Note: verify manomano.fr as well, Issue description: the email si captured but not filled in the username field from the panel (placed in dropdown).