675273 - Stored passwords from desktop sites should auto-fill on mobile sites, and vice versa

Status: RESOLVED DUPLICATE of bug 494593

(Toolkit :: Password Manager, enhancement)

Description

[Gunnar Aas]

Steps to reproduce: 
1. Login to a website that has both desktop and mobile versions (Twitter, Facebook, Tumblr, etc.) on Desktop
2. Sync login information
3. On mobile, change your user agent (using an add-on like phony) to Desktop Firefox, and go to the site that you logged into on desktop, and confirm that your login information has synced.
4. Switch your user agent back to default.
5. Your login information will not appear on the mobile site.

What should happen: 
Your login information should be available across both the desktop and mobile versions of the website.

Comment 1

[Richard Newman [:rnewman]]

Pretty sure this was aimed at Backend :)

(Though it's not really a Sync problem, this will suffice for now.)

I lean towards WONTFIX on this; to me it seems like a problem that sites should address (e.g., by sharing a login interface between desktop and mobile sites), rather than hacking something into Firefox, but I'm keen to hear other points of view.

Comment 2

[Mike Connor [:mconnor]]

It's not even so much about interface sharing as domain sharing.  If I have login.foo.com on desktop, and redirect to m.foo.com on mobile, there's no standard way to know that both login.foo.com and m.foo.com should be treated as the same domains for password autofill purposes.  This might just be a password manager bug/RFE, but I don't think Sync can solve this.

(The same problem exists for, say, mail.google.com and google.com/accounts)

Comment 3

[Richard Newman [:rnewman]]

(In reply to comment #2)
> It's not even so much about interface sharing as domain sharing.

That's what I mean by "login interface". Engineer level of abstraction :)

Comment 4

[Gunnar Aas]

I have an idea for a way this could be done. Say a username and password is saved for example.com, what if with that we also check if common sub-directories like m.example.com and mobile.example.com exist on that domain. If they do exist, the information that was saved for example.com could be copied over to subdirectory.example.com

Comment 5

[Gunnar Aas]

*edit,
common sub-domains.
Also, because of privacy issues, there could be a notification on m.example.com such as "We have noticed you have saved login credentials for example.com, would you like to login with these credentials on m.example.com?"

Comment 6

[Richard Newman [:rnewman]]

Gonna throw this at Password Manager, 'cos how the passwords end up in your database doesn't affect the issue.

Comment 7

[Matthew N. [:MattN]]

This is something we're looking at: both through pre-defined "realms" and allowing the user to choose from credentials on subdomains.