51
submitted 11 hours ago by Blaze@lemmy.zip to c/android@lemdro.id

cross-posted from: https://lemmy.world/post/20572072

Android has had an autofill feature for password managers for years now, but it's broken and needs to be fixed.

top 21 comments
sorted by: hot top controversial new old
[-] scrchngwsl@feddit.uk 4 points 2 hours ago

Autofill is total shit I agree, but I've been copying and pasting from my password manager for over a decade and it's been fine. I get that autofill would be much less friction, but I really don't mind copying and pasting.

[-] kratoz29@lemm.ee 3 points 2 hours ago

Yeah, I agree using Bitwarden in Android can be a mess, but I find it works pretty well with Firefox, now that I mention it, why do people get the Bitwarden extension if the app already works well?

I have access to an iOS device (girlfriend's) and I see it works well and I have never heard her complaining...

[-] d0ntpan1c@lemmy.blahaj.zone 1 points 2 hours ago* (last edited 2 hours ago)

FWIW some of the problems are on website/app developers. Not sure on specifics on the app side, but with websites if the dev doesn't use semantic html input elements with the correct type attribute to denote the password form, autofill won't work (since neither android or the password manager know its time to do stuff)

Nothing wrong with username/password on different screens (one at a time is good for several accessibility-minded reasons) but again, there are some best practices to follow which allow screen readers and password managers to still act as you would expect.

I'd assume android app dev is similar.

That said... I do think it's gotten a bit clunkier at times in ways I dont recall being problematic in the past. I use 1password and heliboard or floris board and while those keyboards seem to bug out a bit, sometimes the bigger problem seems to be that android isn't always telling 1password enough info to find the right account. Idk how apps "inform" the password manager (maybe via url's in a metadata file or maybe passwors managers have ro keep theor own internal db?), but apps that use web wrappers (specifically the old and/or shitty ones) report their url as http://localhost since the wrapper just renders a local page in a web view. that'll wreck a password managers day real quick.

Idk if Android is worse than iOS here, not that it is a reason for google to punt on improving it. iOS has its own autofill quirks thay can be just as annoying. Esp constantly asking if you want to use your app or apple keychain without a way to just pick a default...

[-] smeg@feddit.uk 1 points 3 hours ago

Why Google allows apps to block a system service from inputting information is beyond my understanding, but it’s absolutely infuriating, and just discourages the use of these tools.

This is the really annoying bit

[-] PetteriPano@lemmy.world 3 points 5 hours ago* (last edited 5 hours ago)

I've recently switched from Firefox' vault to bitwarden.

I'd say it works 50% of the time. On desktop Firefox it just doesn't manage to autofill things some days and I end up copy-pasting my credentials.

On mobile is happy to present me with suggested logins for a page. If I have one, pick or generate one, then it's all dandy. If I decide I'd rather not, then there's no way out of that view. I end up force-killing Firefox mobile. Maybe the app works better than the browser extension.

[-] gedaliyah@lemmy.world 1 points 1 hour ago

I never had that issue. Sorry to hear that. I did prefer it when it was lockwise. Having a standalone app was easier to use IMHO but I understand why they integrated it

[-] praise_idleness@sh.itjust.works 18 points 8 hours ago* (last edited 3 hours ago)

Bitwarden(Vaultwarden for me) works fine for me. It does have few hiccups here and there but 90% it works flawlessly.

My only complaint is the passkey support for Firefox variant(Fennec in my case). Kinda weird design choice to have select browsers as trusted and make no other browsers work.

[-] russjr08@bitforged.space 7 points 7 hours ago

That's quite unfortunate to hear. I use Bitwarden along with Gboard and very rarely run into issues - I believe most password managers have a quick settings toggle that you can add into your notification drawer to maybe get around this? From what I know though, these generally use the Accessibility framework to function, and thus will heavily depend on your password manager - it also gives a lot more access to those apps than the built in autofill framework.

Conversely I remember Bitwarden's autofill support on iOS being quirky when I last used it (which to be fair, has been a while - I'm sure its improved since then). IIRC it pretty much always worked in Safari (and Safari Web Views within apps), but the actual applications themselves wouldn't always give me the autofill prompt.

For me though, regardless of the platform it still is far more worth using a password manager and unique passwords per-site than to use a single password (or even a handful) across sites. I hope autofill support improves for those that it doesn't work well with.

[-] linearchaos@lemmy.world 22 points 10 hours ago

Bitwarden is reasonably consistent, but you have to have recently logged into it. Before I open an app that needs auth, I open bw and unlock my vault. Most applications popup login with bitwarden and it can handle 3 stage logins usually even when the ask for 2fa before password.

[-] SatyrSack@feddit.org 1 points 6 hours ago

Before I open an app that needs auth, I open bw and unlock my vault.

What happens when you don't? I definitely have not had to do that.

[-] linearchaos@lemmy.world 1 points 57 minutes ago

I get about a 80% chance of popping the dialogue to fill.

If bitwarden isn't already authed on my Samsung s24U, sometimes it will not pop the autofill with bitwarden button.

If I have opened and authorized bit warden in the previous few minutes the pop rate is very close to 100%

[-] G020B@lemmy.zip 2 points 2 hours ago

It won't automatically suggest the right logins in your keyboard. There will be a chip with "Unlock your vault" or something like that.

[-] workerONE@lemmy.world 1 points 5 hours ago

Proton Pass uses the keyboard to identify and fill passwords. It works really well.

[-] praise_idleness@sh.itjust.works 4 points 3 hours ago

That's how (properly developed/adapted) pasword services(and obviously, keyboards) should work in Android. It's just OS wide settings now.

[-] JustAnotherKay@lemmy.world 2 points 4 hours ago

It works really well.

Like 90% of the time, yeah. There are some websites/apps where it will fuck up and I have to go open the pass app and tap the credentials I need. Still the best option in my opinion, and it only takes a second to go grab the credentials out of the app

[-] solidgrue@lemmy.world 7 points 9 hours ago

I have no specific basis to say so, but I distrust browser-based password managers on the principles of separation of function and mitigating risk. Strong my credentials in a browser just feels hinky, even with a master password. Too obvious of an attack vector. Rather, I use the KeepassDX variant with its MagicKeyboard feature. When I'm presented with a login prompt, I can use the keyboard switcher to launch KeepassDX, unlock my vault, and select the credentials entry. Then I can switch back to the browser (or app) and have MagicKeyboard enter the credentials for me.

It's a few more taps than just that, but it's a straightforward workflow that should mitigate leakage from my usual keyboard, clipboard snooping, and any hypothetical attacks against the in-browser vault workflow.

Plus, I know where my credentials are stored, can apply 2FA, and even back up the vault file to offline archives.

It works for me. "Cool story bro," I guess, is my point.

[-] limerod@reddthat.com 1 points 2 hours ago

Yeah, keepassDX works great. The keyboard function makes up for the 10% finicky apps where autofill cannot work for some reason. I have found only one app where copy-paste is blocked. This works for 99.99% of use cases.

[-] stardust@lemmy.ca 3 points 9 hours ago

KeePass and the Magikeyboard is my favorite go to combo too.

[-] conciselyverbose@sh.itjust.works 8 points 10 hours ago

Apple does better than the Android experience described in the article, but it also isn't perfect. There are apps that don't recognize that you need a password and are difficult to trigger the autofill (especially with a third party manager), and on very rare occasion it fails in the browser, too. It handles multi-page passwords just fine though.

Not trying to measure dicks or whatever, just giving a point of comparison. Without investigating, I wonder if some sites/apps don't correctly indicate to the browser/OS that they're passwords and what they're for. I haven't had real issues on my Android reader with proton pass, though that isn't a huge set of apps I use.

[-] badlotus@lemm.ee 2 points 7 hours ago

Can’t change the default match pattern that iOS uses or add apps to the URI match in Bitwarden iOS. Makes for a few extra clicks on some apps and sites.

[-] BearOfaTime@lemm.ee 3 points 9 hours ago

You nailed it, rhe problem is largely apps not respecting lots of stuff.

this post was submitted on 06 Oct 2024
51 points (91.8% liked)

Android

17485 readers
200 users here now

The new home of /r/Android on Lemmy and the Fediverse!

Android news, reviews, tips, and discussions about rooting, tutorials, and apps.

🔗Universal Link: !android@lemdro.id


💡Content Philosophy:

Content which benefits the community (news, rumours, and discussions) is generally allowed and is valued over content which benefits only the individual (technical questions, help buying/selling, rants, self-promotion, etc.) which will be removed if it's in violation of the rules.


Support, technical, or app related questions belong in: !askandroid@lemdro.id

For fresh communities, lemmy apps, and instance updates: !lemdroid@lemdro.id

💬Matrix Chat

💬Telegram channels / chats

📰Our communities below


Rules

  1. Stay on topic: All posts should be related to the Android OS or ecosystem.

  2. No support questions, recommendation requests, rants, or bug reports: Posts must benefit the community rather than the individual. Please post to !askandroid@lemdro.id.

  3. Describe images/videos, no memes: Please include a text description when sharing images or videos. Post memes to !androidmemes@lemdro.id.

  4. No self-promotion spam: Active community members can post their apps if they answer any questions in the comments. Please do not post links to your own website, YouTube, blog content, or communities.

  5. No reposts or rehosted content: Share only the original source of an article, unless it's not available in English or requires logging in (like Twitter). Avoid reposting the same topic from other sources.

  6. No editorializing titles: You can add the author or website's name if helpful, but keep article titles unchanged.

  7. No piracy or unverified APKs: Do not share links or direct people to pirated content or unverified APKs, which may contain malicious code.

  8. No unauthorized polls, bots, or giveaways: Do not create polls, use bots, or organize giveaways without first contacting mods for approval.

  9. No offensive or low-effort content: Don't post offensive or unhelpful content. Keep it civil and friendly!

  10. No affiliate links: Posting affiliate links is not allowed.

Quick Links

Our Communities

Lemmy App List

Chat and More


founded 1 year ago
MODERATORS