keybase / keybase/keybase-issues

Fix login password remembering in Firefox/Chrome/password managers

Open
#1,591 23 comments 1 reaction 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

Keybase currently does not work with the password management functionality in either Firefox (#21) or Chrome. This issue also extends to external password managers such as LastPass, which may use similar login form detection methods (#1172).

Password saving doesn't work due to multiple reasons:
1. The password field does not have `type="password"` set
2. The username field does not have `type="username"` set (required by Chrome apparently)
3. No actual submit button in the ``
4. No form `action`
5. Disabling/changing default form event handler for form submission due to `preventDefault()` (I didn't dig too deeply into Keybase's JS but it looks like this may also apply)

Compatibility with password managers is an important security concern, as a lack of it encourages weak memorable passwords and password re-use.

References:
[AJAX login form tests](http://ajax-login.mariusgundersen.com/) [(source)](https://github.com/mariusGundersen/ajax-login)
[Firefox's nsLoginManager.js](https://mxr.mozilla.org/firefox/source/toolkit/components/passwordmgr/src/nsLoginManager.js) (`_getPasswordFields()` and `_getFormFields()`)
[Chromium: Prompt to save password after history.pushState()](https://code.google.com/p/chromium/issues/detail?id=357696)
[Chromium: Password saving fails if default submit handler is disabled](https://code.google.com/p/chromium/issues/detail?id=282488)
[Getting Chrome to prompt to save password when using AJAX to login](http://stackoverflow.com/questions/21191336/getting-chrome-to-prompt-to-save-password-when-using-ajax-to-login)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by inspecting Keybase's login form and its JavaScript submission handling, using the linked AJAX login form tests and browser password-manager references as guidance. Done means Firefox, Chrome, and external managers such as LastPass can detect the username and password fields and offer to save credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.