For months now, Proton Pass doesn't know when to suggest to fill in the token. I was expecting it to eventually correct itself upstream as the input is well specified, but I guess no. I don't remember if it was fine with Bitwarden, but on Android I met no problems.
Instead of asking individually passwords managers to correct their behavior, let's try to have a more precise input on what they expect, to help password managers detection.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T356004 Help password managers to detect TOTP login input | |||
| Resolved | sbassett | T232336 Separate recovery codes into a separate 2FA module | |||
| Resolved | taavi | T242031 Allow multiple different 2FA devices | |||
| Resolved | Reedy | T268564 Convert OATHAuth to AbstractSchema | |||
| Resolved | taavi | T330502 Create oathauth_types and oathauth_devices tables | |||
| Resolved | • Marostegui | T348693 Drop oathauth_users table from production | |||
| Resolved | sbassett | T145915 OATHAuth OTP shouldn't be stored in cleartext in the DB |
Phabricator does not offer to add a blocking task, so linking T313058 that wants to disable this mechanism.
Nevermind, I was going to commit more HTML-validation attributes (inputmode="numeric" pattern="\d{6}" minlength="6" maxlength="6"), then I remembered that the same input is used for scratch tokens. Welp.
Even if Proton fixes it after I report it, I still think that the inputmode="numeric" could be a nice add.
No it doesn't. That wants to turn off the autocomplete of previously entered entries to that box, same as T226049: When enabling 2FA, autocomplete is enabled when verifying 2FA, which follows on from T141735: AuthManager shouldn't allow the browser to show suggestions for input fields (autocomplete).
See also: T289086: Allow iOS/macOS/iPadOS to autofill 2fa codes
See T151738: OATH code field should show numeric keyboard on mobile devices.
IMO we should separate the TOTP and scratch token fields (or use the same field but use JS to switch validation rules).
The (rather dumb) rules used by ProtonPass are described here. I guess we'd need to change the field name and ID.