3

I use 32-character (128-bit) randomly generated passwords. It's a little bit hard to remember them all, so I use encrypted keyring built into firefox. In this way I have different passwords to different sites. Moreover, if a domain changes, the event will be visible because I won't be able to use the stored credentials. In order to log in, I use only one device. Its HDDs are also encrypted (FDE). I'm using linux, and also I have separate firefox profiles, each of which is protected by AppArmor (different profiles). I think it's a really secure setup.

Usually when you want to log in to a web service, you just type your login and password and Firefox asks whether you want it to remember the credentials so in the future you won't have to type them manually again. For some reason admins try to prevent from taking this action. One way to achieve that is to use autocomplete="off" in the form. I've managed to bypass this by using the saved-password-editor Firefox addon. It was working so far. Two days ago I encountered a site where this solution simply doesn't work. The problem is that the page has some hidden fields. It looks like this:

<!-- fake fields are a workaround for chrome autofill getting the wrong fields -->
<input style="display:none" type="text" name="fakeusernameremembered"/>
<input style="display:none" type="password" name="fakepasswordremembered" value="fakevaluetopreventpasswordremeber" />
<input type="password" id="password" autocomplete="off" name="password" tabindex="2" placeholder="Hasło"/>
<input style="display:none" type="password" name="anotherfakepasswordremembered" />

The result is that I can't use the stored login/pass. Firefox simply doesn't fill the form. So the question is: how to force Firefox to fill this kind of forms?

1

Have you tried editing the field name using Saved Password Editor's "Edit" feature? Save the logon. Open it in Saved Password Editor. Select the logon, and click edit. You will see a box near the bottom labeled "Password field name". Paste in the name of the real password field. Firefox should be able to match it up after that.

Of course, this won't work if the site is dynamically generating a random name for the password field for each new logon attempt.

In that case, you could remove the unwanted input fields with a custom style sheet. First, add a tool like "Custom Style Script (Inject desired CSS or JS)" add-on to Firefox. Then, write a little bit of CSS to excise input fields where the attributes include type="password" and style="display:none" See this question for a good example of the type of CSS you would need to create.

Once the unwanted fields are out of the way, the password manager should be able to find the field with type password. If you're having trouble, dlete and recreate the password entry once the CSS changes are in place, and make sure the type of password field is "annotated" instead of "web form".

  • Yes, I tried to edit the names. When I order the firefox addon to guess the names, it uses fakeusernameremembered and fakepasswordremembered. The real names are nik and password. But even if I change the names, firefox doesn't fill the form. There's a prompt to unlock the firefox keyring, but nothing happens after that. – Mikhail Morfikov Jun 18 '16 at 5:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.