21

I want to make sure visitors to my website have the best experience possible so I want them to be able to use LastPass and other Password Managers.

Is there any way of identifying whether or not my visitors are using one of these plugins?

  • 19
    What's your idea on "specifically supporting" these plugins...? What do you think requires explicit support? – deceze Apr 10 '16 at 15:10
  • 1
    Related question on Information Security: Can webpages recognize that I saved my password? – unor Apr 11 '16 at 18:19
  • 1
    The idea behind this is that Users like to use form autocompletion tools and LastPass is pretty good at this. It bothers me when I visit a website requiring significant form filling e.g. Hotel reservation websites, airline websites etc... and the web developer hasn't bothered to check whether or not their forms can be populated by LastPass and similar tools. To be fair, I've just realised that this wasn't immediately apparent in the question, but security wasn't the primary motivation behind this comment. – cgarvey Apr 12 '16 at 10:57
  • I think in an ideal world, I'd like to be able to check my analytics tool and see how many of my visitors filled in forms manually, and how many used and browser extension. Hence the question. – cgarvey Apr 12 '16 at 10:58
13

Yes.

Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed.

For instance, using NavigatorPlugins.plugins allows you to get the a PluginArray object, listing the plugins installed in the application:

function getLastPassVersion() {
  var lastpass = navigator.plugins['LastPass'];
  if (lastpass === undefined) {
    // LastPass is not present
    return undefined;
  }
  return lastpass.version;
}

Note also that what you are asking for is commonly implemented and used by browser fingerprinting technologies.

  • Well I'll always prefer to say things you did not say - otherwise all I say would be redundant, wouldn't it? ;) Nevertheless, as you edited away the things I refered to, my comments have become moot (or at least they are now dangling around mid-air) – Hagen von Eitzen Apr 14 '16 at 17:30
  • 1
    Doesn't work at all :/ – Mardzis Oct 4 '16 at 14:04
  • @Mardzis Indeed. MDN reports that browser restrict access to navigator.plugins or return fake results to protect privacy: developer.mozilla.org/en-US/docs/Web/API/NavigatorPlugins/… – Dai Feb 27 at 17:34
46

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it?

By far the best way to support password managers is to use normal <form> tags and a normal form. If you don't do anything clever, then the password manager will do its job.

  • 8
    To add to this: Test with the browser's built-in password manager. If that works, it's highly likely the third-party solutions will work as well. – Kevin Apr 10 '16 at 16:34
  • 6
    I agree, but I have noticed a growing number of websites using angular and other frameworks with extremely complicated forms which don't work with LastPass. Ironically, these websites tend to be the ones which Users really want to use form autocompletion tools with e.g. airline reservations etc.. – cgarvey Apr 11 '16 at 13:35
  • 1
    Note some password manager simulates key presses rather than installing a plugin in the browser. So it is not necessarily the case that if the built-in password manager works that the password manager would also work. In these cases, you usually should make sure tab navigation works correctly. – Lie Ryan Apr 12 '16 at 14:30
3

Most of these password managers are browser plugin based and work by populating the form fields and triggering a form submission as if the ueer pressed the submit button, to the server it appears as a normal form submission, no way to tell if it coming from a password manager.

2

You can use Javascript to detect the typing speed in the username/password fields. A variable rate suggests someone is typing it in manually while a constant rate or even no keystrokes at all (copy-paste) means someone is using a password manager.

  • So if I have LastPass, but it cannot detect the login field and I type manually, do I not have LastPass? – Stephan Bijzitter Apr 11 '16 at 13:15
  • Some password managers copy pastes, others simulates keypresses, and there are also those that gets in the DOM and fills the form directly. Also, some users might type their password in notepad then copy pastes, so they can see what they're typing in the password field. It's not that straightforward to detect password managers. – Lie Ryan Apr 12 '16 at 14:34
2

To answer the actual question, one way to detect if users are using Lastpass is to provide some type of login field and use jQuery or similar to see if Lastpass has inserted the "background-image" it inserts into the login fields it can autofill.

Here's an example of an email input field, all the stuff in the style tag has been added by Lastpass:

<input type="text" class="form-control" id="inputEmail" placeholder="Email" style="cursor: pointer; background-image: url(&quot;data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAASCAYAAABSO15qAAAAAXNSR0IArs4c6QAAAPhJREFUOBHlU70KgzAQPlMhEvoQTg6OPoOjT+JWOnRqkUKHgqWP4OQbOPokTk6OTkVULNSLVc62oJmbIdzd95NcuGjX2/3YVI/Ts+t0WLE2ut5xsQ0O+90F6UxFjAI8qNcEGONia08e6MNONYwCS7EQAizLmtGUDEzTBNd1fxsYhjEBnHPQNG3KKTYV34F8ec/zwHEciOMYyrIE3/ehKAqIoggo9inGXKmFXwbyBkmSQJqmUNe15IRhCG3byphitm1/eUzDM4qR0TTNjEixGdAnSi3keS5vSk2UDKqqgizLqB4YzvassiKhGtZ/jDMtLOnHz7TE+yf8BaDZXA509yeBAAAAAElFTkSuQmCC&quot;); background-attachment: scroll; background-size: 16px 18px; background-position: 98% 50%; background-repeat: no-repeat;" autocomplete="off">

This may not be the most effective way to detect if a user is using Lastpass, but it definitely works :)

  • 2
    Love the thinking behind this solution but doesn't it assume that at least one field on a form can be populated by LastPass? The website I visited that prompted me to ask this question was using an Angular form and LastPass couldn't identify a single field on it. An edge case to be sure but not the last one I'll see I think. – cgarvey Apr 12 '16 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.