Issues with Safari extension

Hello @Tonetony! 👋

Thank you for the feedback and I'm sorry that you're running into a few different issues with 1Password for Safari. I'll respond below: 

Is there really no way to accept auto-fill suggestions with the keyboard? The suggestion(s) are below the user name field, and I find the arrow keys won't let me reach there to select an option. If I press Return, the top suggestion (which is 99% of the time the only match to the site) isn't selected. ONCE IN A WHILE, I have found I can press Tab to reach the suggestion, but that is rare. I have to use the mouse - which is why I have always reverted back to using CMD\ with the non-browser-extension autofill (I don't know what you call that, since it also listed among my Safari extensions).

This is a known issue that is due to limitations with Safari web extensions, our team has reported the issue to Apple and hopefully improvements will come in the future. 

A large percentage of the time, after logging in using 1PW8 browser extension, 1PW then offers to save the login. This is a disturbing pop-up - I made no change, why would I want to say "yes" to that prompt? I always dismiss this unnecessary and misleading pop-up. This is despite my selection in the extension settings, "Autofill & save tab", to NOT "Offer to save logins" - which is explained as offering to save pre-existing logins. Why would anyone want to do this, and it seems it is incapable of honoring my choice in any event.

If you're using the 1Password desktop app's Universal Autofill feature (Command-Backslash) to fill a login then you might be running into a known issue where the 1Password browser extension will try to save that filled login. Try the following: 

1. Open your browser.
2. Right-click the 1Password icon in the toolbar, then choose "Settings".
3. In the "Notifications" section, turn off "Allow 1Password to show unlock notifications".

If that doesn't work and you still see the notification then can you post a screenshot of what you see? 

When I am presented with a field to enter a 1-time code that is texted to me, 1PW extension always provides suggestions in the field. But - the field has no relevance to 1Password, and again, this disturbs me - because 1Password is not recognizing what kind of field this is.

Do you have a 2FA one-time password saved in 1Password for those websites? If you don't then what specifically is 1Password suggesting in those fields? 

If I disable or uninstall the browser extension, the regular CMD\ autofill works, but often very slowly. Is this an automation script? It seems to fill the fields one character at a time, as if Safari invokes it repeatedly for each character. And sometimes it takes 10 seconds to react - as if, after some time period, the script is removed from memory, and takes some time to be reloaded. Besides being slow and ugly, is this automation actually secure?

Universal Autofill is secure and is designed to only fill your logins into code-signed applications using official macOS APIs and integrations.

Does the slowness only happen if 1Password is locked when you invoke Universal Autofill (Command-Backslash)? Or does it also happen when 1Password is already unlocked? Does the issue happen on every website or just some websites? 

Back in the 1PW7 days, 1Password stated there would never be a browser extension per se, just the app extension, because Apple said a browser extension couldn't do the job and wouldn't be secure. How has that changed? 

I'm not sure what you're referring to, can you link me to the statement that you saw so that I can take a look? 1Password 7 came with a browser extension for Safari included with the app.

The current browser extension, 1Password for Safari, uses web extension technology that's used by all modern browsers including Safari. It's not bundled with the app in other to gives customers the choice on whether to also install the desktop app or just use the browser extension by itself. 

Unlike in 1PW7, Safari warns for both 1PW extensions that they can read and alter web pages.

1Password 7's Safari extension required similar permissions: 

The 1Password extension requires access to your browsing history in order to know which website you're visiting so that it knows which login item to suggest. Without this permission 1Password for Safari would have no way to know which login item to suggest and fill/save. You can read more about browser permissions here: About 1Password browser permissions

We do not save or transmit your browsing history and gathering information about you is not our business model. Your browsing history is not collected by 1Password for Safari nor is it ever transmitted off of your device by 1Password. You can read more about our commitment to your privacy in our Privacy Policy: About 1Password and your privacy

The browser extension still offers very little help for most of the settings. Why have you never given a "?" link, or pop-up help, or more text under every setting, or a direct link to a specific web page that explains each option of the settings on a particular tab? Nor have I ever found a set of well-organized page on your web site. It seems that though you made the Safari browser extension the main way to interact with 1PW, it's been left as a weird afterthought, with a bunch of ill-defined options that aren't explained anywhere. One example: What are the differences between "Offer to save and fill logins and other items", "Offer to save items in autofill suggestions", "Offer to save logins", "Offer to save contact information" etc.? There are so many overlaps that are completely unexplained and I just don't understand the effect of these different options.

I'm sorry for the lack of descriptions, you're right that these could be better documented and I'll share this with the team internally. I'll explain what these options mean below: 

• Offer to save and fill logins and other items: This is a general switch to turn off all filling and saving suggestions in the browser. 
• Offer to save items in autofill suggestions: This turns off the "Save in 1Password" button that appears underneath suggestion below a username or password field on a webpage. 
• Offer to save logins and Offer to save contact information: This turns off autosave prompts from appearing in the top right corner of your browser after you sign in to a website using credentials (or if you enter identity/address information) that aren't already saved in 1Password. 
  
  

After generating an updated password, you offer to save the password before the site itself has actually accepted the password.

This is done by design to prevent the password from being lost after the website reloads the page. If you're using the smart password generator, 1Password will try to guess a compatible password for the website. But if the website does reject the password then you can generate a new password and update your saved item in 1Password. 

-Dave

#24063
#36567

For this one:

When I am presented with a field to enter a 1-time code that is texted to me, 1PW extension always provides suggestions in the field. But - the field has no relevance to 1Password, and again, this disturbs me - because 1Password is not recognizing what kind of field this is.

Do you have a 2FA one-time password saved in 1Password for those websites? If you don't then what specifically is 1Password suggesting in those fields

This isn't a 2FA thing, it's where you have a site text you a 1-time code over SMS. (For this particular site, I can confirm I do not have a 2FA one-time password defined in the Login item. I do use those for many other sites, but not this one.) So, at this point I've requested the SMS code, and 1Password pops up first, then its prompt remains there when the SMS code arrives and Apple's auto-fill pop-up lands on top of it.

I've blacked out where it is showing the site address and user name/email address.

This is what happens before the code arrives:

I don't know what it is suggesting. Or if it is suggesting anything. Since it is displaying the site address and my user name, does that mean it's suggesting my user name? I don't think so.

A moment later, Apple pops up with its autofill for the field, covering over part of the 1PW box. I've blacked out the rest.

I've played with that rectangular 1PW box a bit. I can click it just before the Fill code appears, and it turns out I can also click it even with the Fill code blue box on top of it. Either way, the 1PW box disappears for a moment while the down-facing caret turns to the right, then the caret immediately turns back down and the 1PW rectangular box reappears. Clicking the box once is therefore the same as if I were to click the caret twice.

I now see that if I click the square icon in the bottom right hand corner of the 1PW box (the icon with the two horizontal lines -  I guess this icon means "menu?" -  I 'm used to menu being represented by 3 vertical dots or 3 horizontal lines (the "hamburger" icon), then I get this drop-down menu:

So -  does this mean 1PW thinks this looks like a password field, but 1PW has no relevant password, so it is instead offering to generate one?

Now that I see this little menu, well you could say I am indeed reporting an issue! I didn't know this menu was here. All I knew was 1PW was popping up where it didn't belong, and I was ignoring it.

This probably doesn't happen at every site that has a field to enter an SMS code. I see things work properly at bankofamerica.com, for example.