Feature request: autofill login fields after website is loaded (without user interaction)

[victor-marino]

First of all, congrats on this amazing project! This extension is what really sealed the deal for me and allowed me to completely switch over to pass in all my devices.

I've searched the issues (open and closed) and couldn't find anything similar so I'm opening a new one, but apologies in advance if this has been discussed already 🙏🏻

I've noticed that other solutions have a nice feature where the extension will automatically fill the relevant fields (e.g.: username and password) with the best match as soon as the website is loaded, without requiring any user interaction (e.g.: no keyboard shortcut).

At least in my case, browserpass has shown a very, very high degree of reliability, meaning I'm basically CTRL+SHIFT+F'ing my way through 90% of websites without ever having to bring up the credentials menu at all.

I think it would be cool if browserpass offered this as an optional feature, as it would make the experience even more seamless and similar to existing solutions. But maybe there's a reason I'm not aware of that makes this not feasible or desirable.

As a complement to this, I think it would also add a lot of polish if detected fields were marked by a subtle visual, right-aligned indicator (the browserpass logo I guess). This visual cue would help the user understand it was the browserpass extension that filled them out, which is not the case right now.

In fact, I think it would be ideal if this visual indicator was always shown, regardless of the fields having been autofilled or not, just to let the user know a match has been found by browserpass. Possibly even making it clickable to bring up the credentials menu. So let me know if you'd like me to open a separate issue for this second feature, happy to do so 😉

Thanks again!

[maximbaz]

Thanks for the kind words and the suggestions 🙂

Happy to hear that you are generally having a good experience 🥳

To be honest I'm having a bit of an uneasy feeling with a thought of my credentials being automatically, without my explicit consent, being inserted on webpages. Even if we try to play safe and not insert credentials in input fields if we aren't very confident that those are the correct fields (to avoid credentials leak - we do this even today with Ctrl+Shift+F), my personal opinion is that this is just not the right thing to do...

In addition to that, there are several valid use-cases where such feature would degrade user experience:

• Some people use security tokens that require physical confirmation to decrypt credentials (like Yubikey), which means that their Yubikeys would suddenly blink without an apparent reason, which in itself is already quite scary, but also it blocks gpg process until it times out, so you can't cancel it, you can't use gpg for anything else in parallel, and you can't use Yubikey for anything else in parallel (like U2F, FIDO2, ssh, etc).
• Sometimes filling out credentials requires us to show browser confirmation (e.g. if the login form is in an iframe), and if we show such dialogs without explicit user action, it is also quite bad, as it blocks the entire tab, and in some browsers it blocks even the entire browser.

Generally in this project we strive to have few options and provide a great user experience out of the box, so when we don't think the behavior should be enabled by default for everyone, it's already a sign for me to carefully consider this, and in this particular case there are even more restrictions... 🤔

I'm happy to be convinced otherwise, this is just what I personally think at the moment 🙂

---

As for the other visual indication idea, I can see it being useful, so maybe let's indeed have a separate issue to discuss it in more details and gather feedback? The biggest benefit is that we can protect users even more from the situation when Ctrl+Shift+F would place credentials in an incorrect location (and thus possibly leak their credentials), when our form detection algorithm makes a mistake. Back when I used LastPass I always hated that their icon covered part of the input field ( 😅 ), but I feel like it is not impossible to do it correctly, just one other idea (not necessarily the best one), we could highlight the field with a border, rather than with an icon inside it.

[victor-marino]

Thanks for your prompt and detailed response!

Well, it looks like I was indeed overlooking a few potential side effects, yeah 😅

To be fair, I've never experienced any of those issues after years of using other password managers (e.g.: Chrome's native one). But I can see why this wouldn't be a trivial problem to control, especially considering the "general purpose" nature of pass and the wide range of information one may store in it.

So I think I agree with you that it's probably best not to pursue this, unless someone has a different view of course.

---

Regarding the visual indicator, I fully agree with your view. Right now we just press the shortcut blindly without really knowing if browserpass will fill out your username, your password, both or none. This could help improve that user experience a lot.

I'm partial to the (subtle) icon because it lets you know specifically which extension is triggering it, as people might have a million other extensions running on their browsers. But yeah let's discuss the details in a separate issue. I'll create it later.