UI required?

[DamienCassou]

I've read that you plan to work on a UI for this extension. I'm not sure why that is needed. What I need is that when there is an OTP form field somewhere in the page, this field is automatically filled with the OTP token such that I just have to press RET or click the submit button.

What do others need?

[erayd]

Token refresh, token copy in a way that doesn't conflict, token visibility to see it and enter elsewhere. And OTP fields aren't standardised, so there will be quite a few that can't be properly detected for autofill.

A UI is definitely required. It can be a fairly simple UI though.

[DamienCassou]

Ok, thank you for your answer. Is autofilling of OTP form fields (when it's possible) a planned feature?

[erayd]

I'll attempt it. I'm not sure how practical it's going to be, but I'm certainly happy to see if I can come up with something useful in that regard.

[apiraino]

If I can add my .2 cents to the conversation, I'd downvote this feature.

Autofilling an OTP field behind my back is something I wouldn't wish for, because:

• some websites (e.g. amazon.*) log you in separate steps (usr/pwd then otp). It may not be that easy to always understand that that single field is an otp field.
• you don't want to generate otp codes for no reason (possibly leaking useful infos for an attacker): a single field can theoretically be forged to fool the extension. Basically, I want full reponsibility for my actions and I'll happily give up a little automation for that.
• and finally (and foremost) if you're not paying attention and you're on a phishing site, you're happily granting full access to the attacker.

All in IMO, of course. Happy to discuss these points, tho!

[erayd]

@apiraino Agree completely. We won't be autofilling anything unless the user specifically triggers it. It'll be similar to what browserpass does by default now - you'll have to click something, or hit a key combo, before it makes an attempt to fill things.

[erayd]

Just to clarify what you're voting against here - is it the filling magically happening without you asking that you are objecting to (which was not something we ever planned), or the entire concept of being able to trigger a form fill at all?

[apiraino]

I'm downvoting specifically this:

when there is an OTP form field somewhere in the page, this field is automatically filled with the OTP token such that I just have to press RET or click the submit button

As you correctly pointed out, the user should trigger the otp token generation (ideally with a keyb shortcut). As a bonus, the extension will do its best to find and fill the otp field.

[max-baz]

I'm curious if you guys are thinking about using popup or injecting UI directly inside the webpage (like it was in v2), or both? Popup has a drawback of being closed automatically when user focuses a webpage, so if you want people to look at codes and type OTP codes themselves, popup would probably not be a good place to display the codes.

[erayd]

Probably the popup, at least to start with. The injected UI would still be at an edge (so not really much closer), and codes are generally six digits long anyway - most people will type that in one go. If they want another look, there's nothing stopping then simply opening the popup again. There are a fair few disadvantages to using an injected UI.

Longer term, I'd quite like to put an "insert OTP code here" item on the right-click menu.

[ashkitten]

the way i figured, it'd give you a way to put it on the clipboard so typing wouldn't matter. i haven't seen anything i couldn't paste an otp into anyways

[erayd]

@ashkitten Yes, that as well.

[apiraino]

I second what @ashkitten says, but I'm quite neutral on the UI choice.

[erayd]

Popup UI implemented in #7. Options screen still to come.

[erayd]

Popup implemented ages ago in #7, options screen discussion in #8, so keeping this issue open now seems redundant.