Enforce a minimum length for user-adjusted generated passwords |
|||||||
Issue descriptionUsers can adjust generated passwords after their generation while the password generation drop down is still visible. We should impose a minimum length of n. Proposal: n=3 If the password gets shorter than n, we: - delete the pre-saved credential from the credential store - reset the password generation drop-down, i.e. generate and offer a new password (we don't fill it, yet) If we don't impose a minimum threshold we get into a weird state when the user deletes one character at a time until they arrive at 1 (or even 0) characters.
,
Aug 2
- Minimum length for a manually edited suggested password while still being in "Saved Password" mode: 4 -- (at length 3, we drop the current credential from the credential store, regenerate a suggested password and go into "Use suggested password" mode) - Maximum length for a manually edited password while still being in "Use suggested password" mode: 5 -- (at length 6 we drop the suggestion drop-down)
,
Aug 6
,
Aug 9
Note the side affect of this change. If user generated a password and then deletes the characters one by one we normally copy the input into "Confirm new password". However, once it reaches 3 chars the password is copied the last time. From now on any modifications in the "New password" field are not reflected in the "Confirm new password".
,
Aug 9
I think that's fine since the automatic password generation action is cancelled at this point time. The user falls back into the regular mode of entering passwords manually. However, I agree that it's odd to leave behind 3 disconnected chars in the "Confirm password" field. WDYT about clearing the "Confirm password" field in this state?
,
Aug 9
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/74d03b21862c510c4be73100103b343f87dbc7a5 commit 74d03b21862c510c4be73100103b343f87dbc7a5 Author: Vasilii Sukhanov <vasilii@chromium.org> Date: Thu Aug 09 13:24:52 2018 Set the minimum length of the generated password to 4. Dismiss the generation prompt when > 5 characters typed. Bug: 869890 ,859472 Change-Id: Ib842b92857a79e92e411e7247ad0cc4a322dd364 Reviewed-on: https://chromium-review.googlesource.com/1167507 Reviewed-by: Vadym Doroshenko <dvadym@chromium.org> Commit-Queue: Vasilii Sukhanov <vasilii@chromium.org> Cr-Commit-Position: refs/heads/master@{#581885} [modify] https://crrev.com/74d03b21862c510c4be73100103b343f87dbc7a5/chrome/renderer/autofill/password_generation_agent_browsertest.cc [modify] https://crrev.com/74d03b21862c510c4be73100103b343f87dbc7a5/components/autofill/content/renderer/password_generation_agent.cc [modify] https://crrev.com/74d03b21862c510c4be73100103b343f87dbc7a5/components/autofill/content/renderer/password_generation_agent.h
,
Aug 10
Can we confirm this in Canary and ask for merge approval to M69?
,
Aug 10
Today's WIN Canary is at revision 582029, so I expect this change to be in. Max can you verify this looks good?
,
Aug 10
Just checked on Canary 70.0.3518.0 (macOS). Suggested passwords are being unsaved when below 4 chars, however we don't suggest a new password, see attached screencast.
,
Aug 10
Max, you are not testing the automatic generation. There are two different and loosely related things: automatic generation and manual generation. For the automatic one everything works as discussed. For the manual we don't bring up the prompt back automatically (because it was manual): you manually selected to generate password, didn't like it, erased it. If you changed the mind then you can manually generate it again.
,
Aug 10
I'd like to merge r581885 back. It's a UI fix for the password generation that we consider launch blocking.
,
Aug 10
This bug requires manual review: M69 has already been promoted to the beta branch, so this requires manual review Please contact the milestone owner if you have questions. Owners: amineer@(Android), kariahda@(iOS), cindyb@(ChromeOS), govind@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 10
Cool, yes it works as expected for automatic password generation, thanks.
,
Aug 10
Release managers: this is a bug fix for a pretty visible feature bug we encountered. It's launch blocking for password generation in M69. Thanks Vasilii, and Max!
,
Aug 10
Approving merge to M69 branch 3497 based on comment #12 and #15, pls merge before 4:00 PM PT Monday (08/13). Thank you.
,
Aug 10
M69 merge approval is for r581885.
,
Aug 13
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/ddadbcabbd6f3e27c424c55cbb55bbd2060ace21 commit ddadbcabbd6f3e27c424c55cbb55bbd2060ace21 Author: Vasilii Sukhanov <vasilii@chromium.org> Date: Mon Aug 13 08:54:50 2018 Set the minimum length of the generated password to 4. Dismiss the generation prompt when > 5 characters typed. TBR=vasilii@chromium.org (cherry picked from commit 74d03b21862c510c4be73100103b343f87dbc7a5) Bug: 869890 ,859472 Change-Id: Ib842b92857a79e92e411e7247ad0cc4a322dd364 Reviewed-on: https://chromium-review.googlesource.com/1167507 Reviewed-by: Vadym Doroshenko <dvadym@chromium.org> Commit-Queue: Vasilii Sukhanov <vasilii@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#581885} Reviewed-on: https://chromium-review.googlesource.com/1172286 Reviewed-by: Vasilii Sukhanov <vasilii@chromium.org> Cr-Commit-Position: refs/branch-heads/3497@{#561} Cr-Branched-From: 271eaf50594eb818c9295dc78d364aea18c82ea8-refs/heads/master@{#576753} [modify] https://crrev.com/ddadbcabbd6f3e27c424c55cbb55bbd2060ace21/chrome/renderer/autofill/password_generation_agent_browsertest.cc [modify] https://crrev.com/ddadbcabbd6f3e27c424c55cbb55bbd2060ace21/components/autofill/content/renderer/password_generation_agent.cc [modify] https://crrev.com/ddadbcabbd6f3e27c424c55cbb55bbd2060ace21/components/autofill/content/renderer/password_generation_agent.h
,
Aug 13
|
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by nepper@chromium.org
, Aug 2