autofill risks?

Hello @pquimo, thanks for writing in. I do understand where you're coming from, as internet security is an important thing to be mindful of these days.

However, 1Password does not autofill in browsers by default and user input is required by either clicking on the inline menu suggestion, using a keyboard shortcut or by using 'Open and Fill'.

May I ask if you have the browser's built-in password manager enabled or any other extensions installed in your browser?

Thank you so much for the reply! I use the Open and Fill from the MacOS app a lot, so I was thinking of that as "on page load autofill", but I can see why that user action on my part may exclude it from the risks BitWarden is talking about. I am not using the built-in password manager, and I don't have any other relevant extensions - I just wasn't thinking quite right about what on page load autofill is.

It sounds like the view 1Password has on this is it's dangerous enough that they don't even have a checkbox that lets you do it like BitWarden does, which is fine for me. The way 1Password works is so smooth and efficient, that I'm not worried about missing that. When I am logging in from within the browser, rather than initiating from the app, I use the hotkey and that works great for me.

My question remains though, and as a software developer, I'd be happy with a deeply technical answer, as I expect this might need to be. Why is the on page load autofill a risk -- 1Password doesn't support it, and BitWarden warns against it, so I'm convinced, but I'm still curious to understand.

Thank you.

@pquimo

Thanks for the reply. Automatic filling of credentials, without any input from the user, could lead to a malicious page carrying out an attack where it collects usernames and passwords. 1Password does not offer automatic filling (without user action) in order to protect against this threat.

One of my colleagues wrote a more technical explanation all the way back in 2014: https://1password.community/discussion/comment/153916/#Comment_153916

Let me know if you have any questions. 🙂

-Dave

Ah perfect, that is exactly what I was looking for. So very much appreciated! And of course, props to 1Password for getting it right so early. Good stuff.

Hey @pquimo, thanks for getting back to us and the kind words, your positive feedback is much appreciated. Let us know if there's anything else we can help you with. 🙂