Support for websites that show only a username field.

[SkettiSouls]

When trying to use the userscript on sites that show only the username field initially (i.e. twitter), I get a popup saying "No Credentials form found".

The plugin for other browsers handles this with the "Add Username-only option for this site" after redecting login fields, is there anything similar that can be done with the userscript?

Error:

Other Browsers' Solution:

[ususdei]

Yeah, the difficulty here is mainly detecting a form which is supposed to be a login form.
This plugin currently does this by searching for password fields ( in hasPasswordField() ) since password fields can be detected easily and reliably.
Unfortunately I'm not aware of any reliable way to detect username fields. Oftentimes they are just plain text fields.
So we would have to maintain some reasonably reliable heuristics for that.
For X.com only the autocomplete="username" propertly seems to be usable at all. I don't know how well this works for other sites.

So I'd like to suggest the following:
We collect more sites that use those odd login forms in the comments of this item.
When we have collected enough of them, we can inspect their login forms and see whether we can come up with a
resonably good heuristic to identify username fields.

[ususdei]

https://X.com

[SkettiSouls]

I see, is hasPasswordField() a javascript thing? That would explain certain sites (for example kingdom of loathing which is like entirely php afaik) not being able to detect login fields.

[SkettiSouls]

google is another site that does username only at first.

[jrpie]

What about adding an option to type fill the username / password / TOTP into the field the user has currently selected (using :insert-text, similar to what e.g. qute-keepass does)?

I'd suggest to add an option --input-method with values:

• auto (default) - the current js-based method
• type-username - use :insert-text
• type-username-tab-password
• type-password
• type-totp

Users could then use different keybindings for those.
This is still much more comfortable than selecting the entry from KeePassXC manually (and more secure, since the userscript can check whether the URL matches). Automatic detection is nice, but it will never cover all cases.

[ususdei]

I just thought about implementing this --input-method in a more generic way
and drafted something like --input-sequence={USERNAME}{TAB}{PASSWORD} so you could cover all those mentioned cases and more using only one argument.

But then I realized that I'm essentially just reimplementing the Autotype feature which keypass itself already provides.
Apparently that just doesn't work on wayland yet. But otherwise AutoType should be the better way to go.

[jrpie]

Compared to AutoType doing this in the userscript still has the benefit that we are able to automatically select the correct entry from keepass (by URL!). As far as I see AutoType relies on the window title, which a phising site can easily copy.
Using the URL from qutebrowser helps to prevent phishing (as we have access to the actual URL and don't need to guess based on page title)

[ususdei]

Compared to AutoType doing this in the userscript still has the benefit that we are able to automatically select the correct entry from keepass (by URL!). As far as I see AutoType relies on the window title, which a phising site can easily copy. Using the URL from qutebrowser helps to prevent phishing (as we have access to the actual URL and don't need to guess based on page title)

Ah sure. But apparently one can also request an autotype for a specific URL using the browser integration API.
I quickly implemented that in a separate branch (feat_autotype) for now.
Unfortunately it does not work for me yet. But probably because I'm still on wayland.

[ususdei]

So I also implemented the detection of credential fields using the autocomplete field in the master branch.
It seems to work for google.com but not for twitter X because the morons at X just don't want to wrap their input fields in proper standard forms... -.-