I want to make sure visitors to my website have the best experience possible so I want them to be able to use LastPass and other Password Managers.
Is there any way of identifying whether or not my visitors are using one of these plugins?
-
19What's your idea on "specifically supporting" these plugins...? What do you think requires explicit support?– decezeCommented Apr 10, 2016 at 15:10
-
1Related question on Information Security: Can webpages recognize that I saved my password?– unorCommented Apr 11, 2016 at 18:19
-
1The idea behind this is that Users like to use form autocompletion tools and LastPass is pretty good at this. It bothers me when I visit a website requiring significant form filling e.g. Hotel reservation websites, airline websites etc... and the web developer hasn't bothered to check whether or not their forms can be populated by LastPass and similar tools. To be fair, I've just realised that this wasn't immediately apparent in the question, but security wasn't the primary motivation behind this comment.– cgarveyCommented Apr 12, 2016 at 10:57
-
I think in an ideal world, I'd like to be able to check my analytics tool and see how many of my visitors filled in forms manually, and how many used and browser extension. Hence the question.– cgarveyCommented Apr 12, 2016 at 10:58
Add a comment
|
5 Answers
Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it?
By far the best way to support password managers is to use normal <form> tags and a normal form. If you don't do anything clever, then the password manager will do its job.
-
8To add to this: Test with the browser's built-in password manager. If that works, it's highly likely the third-party solutions will work as well.– KevinCommented Apr 10, 2016 at 16:34
-
6I agree, but I have noticed a growing number of websites using angular and other frameworks with extremely complicated forms which don't work with LastPass. Ironically, these websites tend to be the ones which Users really want to use form autocompletion tools with e.g. airline reservations etc..– cgarveyCommented Apr 11, 2016 at 13:35
-
1Note some password manager simulates key presses rather than installing a plugin in the browser. So it is not necessarily the case that if the built-in password manager works that the password manager would also work. In these cases, you usually should make sure tab navigation works correctly.– Lie RyanCommented Apr 12, 2016 at 14:30
Yes.
Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed.
For instance, using NavigatorPlugins.plugins allows you to get the a PluginArray object, listing the plugins installed in the application:
function getLastPassVersion() {
var lastpass = navigator.plugins['LastPass'];
if (lastpass === undefined) {
// LastPass is not present
return undefined;
}
return lastpass.version;
}
Note also that what you are asking for is commonly implemented and used by browser fingerprinting technologies.
answered Apr 10, 2016 at 11:11
-
Well I'll always prefer to say things you did not say - otherwise all I say would be redundant, wouldn't it? ;) Nevertheless, as you edited away the things I refered to, my comments have become moot (or at least they are now dangling around mid-air) Commented Apr 14, 2016 at 17:30
-
2
-
@Mardzis Indeed. MDN reports that browser restrict access to
navigator.pluginsor return fake results to protect privacy: developer.mozilla.org/en-US/docs/Web/API/NavigatorPlugins/…– DaiCommented Feb 27, 2019 at 17:34
Most of these password managers are browser plugin based and work by populating the form fields and triggering a form submission as if the ueer pressed the submit button, to the server it appears as a normal form submission, no way to tell if it coming from a password manager.
answered Apr 10, 2016 at 10:46
You can use Javascript to detect the typing speed in the username/password fields. A variable rate suggests someone is typing it in manually while a constant rate or even no keystrokes at all (copy-paste) means someone is using a password manager.
-
So if I have LastPass, but it cannot detect the login field and I type manually, do I not have LastPass? Commented Apr 11, 2016 at 13:15
-
Some password managers copy pastes, others simulates keypresses, and there are also those that gets in the DOM and fills the form directly. Also, some users might type their password in notepad then copy pastes, so they can see what they're typing in the password field. It's not that straightforward to detect password managers.– Lie RyanCommented Apr 12, 2016 at 14:34
To answer the actual question, one way to detect if users are using Lastpass is to provide some type of login field and use jQuery or similar to see if Lastpass has inserted the "background-image" it inserts into the login fields it can autofill.
Here's an example of an email input field, all the stuff in the style tag has been added by Lastpass:
<input type="text" class="form-control" id="inputEmail" placeholder="Email" style="cursor: pointer; background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAASCAYAAABSO15qAAAAAXNSR0IArs4c6QAAAPhJREFUOBHlU70KgzAQPlMhEvoQTg6OPoOjT+JWOnRqkUKHgqWP4OQbOPokTk6OTkVULNSLVc62oJmbIdzd95NcuGjX2/3YVI/Ts+t0WLE2ut5xsQ0O+90F6UxFjAI8qNcEGONia08e6MNONYwCS7EQAizLmtGUDEzTBNd1fxsYhjEBnHPQNG3KKTYV34F8ec/zwHEciOMYyrIE3/ehKAqIoggo9inGXKmFXwbyBkmSQJqmUNe15IRhCG3byphitm1/eUzDM4qR0TTNjEixGdAnSi3keS5vSk2UDKqqgizLqB4YzvassiKhGtZ/jDMtLOnHz7TE+yf8BaDZXA509yeBAAAAAElFTkSuQmCC"); background-attachment: scroll; background-size: 16px 18px; background-position: 98% 50%; background-repeat: no-repeat;" autocomplete="off">
This may not be the most effective way to detect if a user is using Lastpass, but it definitely works :)
-
2Love the thinking behind this solution but doesn't it assume that at least one field on a form can be populated by LastPass? The website I visited that prompted me to ask this question was using an Angular form and LastPass couldn't identify a single field on it. An edge case to be sure but not the last one I'll see I think.– cgarveyCommented Apr 12, 2016 at 10:54