Username and Password saving not fully working

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-07-02, 13:57

I am having varied levels of success with saving usernames and passwords in the browser.
For some sites, when I load the login page, the fields are populated.
For other sites, nothing is populated.
And yet others which have you enter your username on one page and have you enter your password on the next, only store the password.
For one, the username doesn't even show up in a drop down list (the drop down list instead shows several usernames that I have typed in to other sites). I cleared the cache for the site but that did not help.
I do not notice any pattern.

Here is the info about my computer and install:

Goodydino · Unread post by **Goodydino** » 2018-07-02, 20:02

Are you allowing cookies for sites where you need to log in? Do you have the browser set to save passwords (which will also save user names)?

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-07-07, 00:24

Yes, I have both of those settings enabled.
I also just tried deleting the cookies and then revisiting the site. But, that did not help.

As an aside, I would not think that I need cookies enabled for this. The idea, as I understand, is to have the web browser notate and record the data. There is no need for the website to handle "duties." Correct me if I am wrong or misunderstanding the technology.

doofy · Unread post by **doofy** » 2018-07-07, 01:17

floatingkeyboards wrote:As an aside, I would not think that I need cookies enabled for this. The idea, as I understand, is to have the web browser notate and record the data. There is no need for the website to handle "duties." Correct me if I am wrong or misunderstanding the technology.

The browser remembers log in details independently of cookies. You only need log in specific cookies while you are logged into a site.

I wonder if you've set PM to clear history on exit, and have set your prefs too aggressively.

Or, failing that, if you have a privacy tool of some kind, that you don't really know what it's doing. There are several custom "privacy" user.js files floating about, that no one knows what they are doing when they happily add them to their browsers.

Search your profile for user.js and if you find one, open it in a txt editor and see whats in it. There should be a max of four entries. If you see a hundred, investigate them very carefully.

And then there are privacy extensions that do more than you expect. Eclipsed Moon is my favourite example of this - you install it cos you want a U/A changer and it's easy to overlook the fact that, by default, it erases all site info on browser exit.

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-07-10, 19:48

No settings seems to be at particularly high extremes.
Also, I don't have any privacy software installed on my computer

The only thing that I think is a bit out of the norm is that in the username dropdown list on GoDaddy, there are a lot of usernames listed. I am referring to what's basically an autocomplete too. I'd say there is about 10 of them. These are all usernames or email addresses of mine, but none of them are for the particular site in question.

One thing that I notice with Pale Moon is that you don't seem to be able to edit the usernames and passwords for sites using the Pale Moon permissions page. When you click on individual sites, the "manage passwords" is greyed out. When you click at the top left "all sites," the software doesn't let you actually edit anything there. Maybe someone else can confirm and then I can post it as a bug.

coffeebreak · Unread post by **coffeebreak** » 2018-07-10, 22:02

floatingkeyboards wrote:For some sites, when I load the login page, the fields are populated.
For other sites, nothing is populated.

Some sites deliberately set up their log-in form to prevent credentials from autofilling. There isn't a universal fix for this.

floatingkeyboards wrote:One thing that I notice with Pale Moon is that you don't seem to be able to edit the usernames and passwords for sites using the Pale Moon permissions page.

There's an extension, Classic Password Editor that helps with this.

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-07-11, 18:44

Some sites deliberately set up their log-in form to prevent credentials from autofilling. There isn't a universal fix for this.

On my last install of Windows 10 (I reinstalled about 3 weeks ago), that credentials would auto fill. It only stopped working after I reinstalled Windows 10 and Pale Moon. I suppose it's possible that that was just happened to coincide with another change, either by Pale Moon or by the Go Daddy site.

There's an extension, Classic Password Editor that helps with this.

That looks like it should help. I will have to try it out later.

yami_ · Unread post by **yami_** » 2018-07-11, 19:24

floatingkeyboards wrote:On my last install of Windows 10 (I reinstalled about 3 weeks ago), that credentials would auto fill. It only stopped working after I reinstalled Windows 10 and Pale Moon. I suppose it's possible that that was just happened to coincide with another change, either by Pale Moon or by the Go Daddy site.

Pale Moon release notes, version 27.7.0 wrote:Security/privacy fixes:
Disabled automatic filling in of log-in details by default to prevent potential risks of credentials being abused (e.g. for tracking) or stolen.

Added a preference (in the category security) to easily enable or disable automatic filling in of log-in data.

coffeebreak · Unread post by **coffeebreak** » 2018-07-11, 22:43

floatingkeyboards wrote:On my last install of Windows 10 (I reinstalled about 3 weeks ago), that credentials would auto fill. It only stopped working after I reinstalled Windows 10 and Pale Moon.

yami_ wrote:
Pale Moon release notes, version 27.7.0 wrote:Security/privacy fixes:
Disabled automatic filling in of log-in details by default [...]

[emphasis added]
See posts re the security basis for this change here and here.

@floatingkeyboards, to be clear what this change looks like...
Since release of 27.7.0:

Passwords no longer autofill by default.
But they do still autofill after conscious user interaction
Conscious Interaction =
1. Click the username field to display the username;
2. Click the displayed username to make the password fill in.

It's possible (but less secure) to restore the former behavior with a setting:
Preferences > Security > Password section
Tick the box next to: Automatically fill in log-in details

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-10-03, 23:34

yami_ wrote:
Pale Moon release notes, version 27.7.0 wrote:Security/privacy fixes:
Disabled automatic filling in of log-in details by default to prevent potential risks of credentials being abused (e.g. for tracking) or stolen.

Added a preference (in the category security) to easily enable or disable automatic filling in of log-in data.

I am curious why auto filling the credentials allows the web server to track you more. Do some web servers take screen shots? Or somehow reading that data through cookies? I would have thought the the web server can't read form data that has not yet been submitted. Admittedly, I don't know much about the subject matter.

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-10-04, 00:03

coffeebreak wrote:
It's possible (but less secure) to restore the former behavior with a setting:
Preferences > Security > Password section
Tick the box next to: Automatically fill in log-in details

With a lot of the sites that I log into, the web browser does not autopopulate the login information. However, I do see that it populates for some sites.

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-10-04, 00:13

The only reason that I can think of as to why the Go daddy site has all of my user names except for the one that is actually appropriate for that site is because the G odaddy site is somehow similar to various other websites and so the browser mistakes it for other websites. The thing that's unique about the Go Daddy site is that I probably first logged into all the other sites before I logged into the GoDaddy site (after installing Pale Moon).

coffeebreak · Unread post by **coffeebreak** » 2018-10-04, 02:16

floatingkeyboards wrote:I am curious why auto filling the credentials allows the web server to track you more.

coffeebreak wrote:See posts re the security basis for this change here and here.

therube · Unread post by **therube** » 2018-10-04, 02:40

(Talking out my butt here...)

Something like "form fill" stores data based on a "type" of input "form".
So possible that multiple sites use the same types of "forms'.

So you enter one username for here, another username for another site, & a third username for a third site.
All using the "type of form", so all 3 usernames are valid for the "form type", rather then valid for a specific "site".

Now your actual username is specific to the site, but what is recorded by PM, what is able to be "filled in" by PM can be any number of entries - for that "form", not necessarily for that site.

Not all sites use the same "forms", & each different "form" would save its own username data - for that form.

As mentioned, some sites don't allow saving of passwords (or even form data).
Workarounds may work, or not, or on particular sites, & not others.

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-12-01, 14:18

doofy wrote:
floatingkeyboards wrote: Search your profile for user.js and if you find one, open it in a txt editor and see whats in it. There should be a max of four entries. If you see a hundred, investigate them very carefully.

I can't seem to find the file "user.js" (without the quotes).
I even searched my entire hard drive

Nigaikaze · Unread post by **Nigaikaze** » 2018-12-01, 17:14

floatingkeyboards wrote:I can't seem to find the file "user.js"

You won't necessarily have one. If you do, it would be in your profile folder.

floatingkeyboards · Unread post by **floatingkeyboards** » 2018-12-01, 17:31

Nigaikaze wrote: You won't necessarily have one. If you do, it would be in your profile folder.

I think I see the directory that you are talking about. In Windows 8.1 its

yourWindowsUsername/AppData/Roaming/Moonchild Productions/PaleMoon/Profiles

In there is a single folder "z77yn3ol.default" (without the quotes)

I don't have the user.js in that folder & I have hidden files showing so I must just not have that file. I am guessing that you would only have it if you have multiple profiles set up for Pale Moon. Having more profiles seems like something that I should look into. I'm intrigued; just have to make the time to read up on that.

Nigaikaze · Unread post by **Nigaikaze** » 2018-12-01, 17:52

floatingkeyboards wrote:I think I see the directory that you are talking about.

The easiest way to find your profile folder is to go into Help > Troubleshooting Information. In the "Application Basics" section, there's an entry for "Profile Folder" with an "Open Folder" button next to it. Clicking on that button opens the folder for the current profile that you're using. In your case, yes, that z77yn3ol.default folder is your profile folder.

floatingkeyboards wrote:I am guessing that you would only have it if you have multiple profiles set up for Pale Moon.

The user.js file is used to basically lock down preferences. As such, it is normally only in a profile if someone has deliberately put it there. If someone were using this method with multiple profiles, they would have a user.js file in each profile folder.

Unread post by **Moonchild** » 2018-12-02, 04:48

To clarify: the browser will read a user.js file on startup and will apply those settings regardless of what a user might have changed them to in the previous run. They won't be "locked down" (that is a different function preventing them from being altered entirely) but will be set to whatever is in the user.js every browser start.

Nigaikaze · Unread post by **Nigaikaze** » 2018-12-02, 15:44

Thanks for the clarification, Moonchild.

Pale Moon forum

Username and Password saving not fully working

Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working

Re: Username and Password saving not fully working