New issue
Advanced search Search tips

Issue 873647 link

Starred by 1 user

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 3
Type: Bug



Sign in to add a comment

jcpenney.com shows password generation on wrong field

Project Member Reported by battre@google.com, Aug 13

Issue description

Steps to reproduce:

1) Visit https://mega.nz/register
2) Open dev tools
3) Click on "Toggle Device Toolbar" so that the page is loaded as a mobile page.
4) Refresh the page.

We get the following on chrome://password-manager-internals:

Server predictions: {
Signature of form: 8635218557430209065
Origin: https://mega.nz/
Action: https://mega.nz/
Form fields: 
: 1318412689, type=text, renderer_id = 491
: 1318412689, type=text, renderer_id = 492
: 2964261712, type=email, renderer_id = 493
: 475301429, type=password, renderer_id = 494, SERVER_PREDICTION: ACCOUNT_CREATION_PASSWORD
: 475301429, type=password, renderer_id = 495, SERVER_PREDICTION: ACCOUNT_CREATION_PASSWORD
: 1067852723, type=checkbox, renderer_id = 496
}
Form parsing input: {
Origin: https://mega.nz/
Action: https://mega.nz/
Main frame origin: https://mega.nz/
Form name: 
Form with form tag: true
Form renderer id: 36
Form fields: 
: type=text, renderer_id = 491, visible, empty
: type=text, renderer_id = 492, visible, empty
: type=email, renderer_id = 493, visible, empty
: type=password, renderer_id = 494, visible, empty
: type=password, renderer_id = 495, visible, empty
: type=checkbox, renderer_id = 496, invisible, non-empty
}
Form parsing output: {
Action : https://mega.nz/ ,
New password element : ,
Origin : https://mega.nz/ ,
PSL match : false,
Password element : ,
Password element renderer id : 494 ,
Password generated : false,
Scheme : HTML ,
Signon realm : https://mega.nz/ ,
Times used : 0,
Username element : ,
Username element renderer id : 493 
}

This means:
1) The site has no name/id attributes on the registration form (only the mobile version of this site).
2) The new renderer_ids actually improve the situation in the sense that we can distinguish the fields.
3) The server treats both fields the same (they have the same signature).

We could
a) disable password generation in these situations
b) try to find some way to use field indices.
 

Sign in to add a comment