Issues with Safari extension

Hello Tonetony​! 👋

Thank you for the feedback and I'm sorry that you're running into a few different issues with 1Password for Safari. I'll respond below: 

Is there really no way to accept auto-fill suggestions with the keyboard? The suggestion(s) are below the user name field, and I find the arrow keys won't let me reach there to select an option. If I press Return, the top suggestion (which is 99% of the time the only match to the site) isn't selected. ONCE IN A WHILE, I have found I can press Tab to reach the suggestion, but that is rare. I have to use the mouse - which is why I have always reverted back to using CMD\ with the non-browser-extension autofill (I don't know what you call that, since it also listed among my Safari extensions).

This is a known issue that is due to limitations with Safari web extensions, our team has reported the issue to Apple and hopefully improvements will come in the future. 

A large percentage of the time, after logging in using 1PW8 browser extension, 1PW then offers to save the login. This is a disturbing pop-up - I made no change, why would I want to say "yes" to that prompt? I always dismiss this unnecessary and misleading pop-up. This is despite my selection in the extension settings, "Autofill & save tab", to NOT "Offer to save logins" - which is explained as offering to save pre-existing logins. Why would anyone want to do this, and it seems it is incapable of honoring my choice in any event.

If you're using the 1Password desktop app's Universal Autofill feature (Command-Backslash) to fill a login then you might be running into a known issue where the 1Password browser extension will try to save that filled login. Try the following: 

1. Open your browser.
2. Right-click the 1Password icon in the toolbar, then choose "Settings".
3. In the "Notifications" section, turn off "Allow 1Password to show unlock notifications".

If that doesn't work and you still see the notification then can you post a screenshot of what you see? 

When I am presented with a field to enter a 1-time code that is texted to me, 1PW extension always provides suggestions in the field. But - the field has no relevance to 1Password, and again, this disturbs me - because 1Password is not recognizing what kind of field this is.

Do you have a 2FA one-time password saved in 1Password for those websites? If you don't then what specifically is 1Password suggesting in those fields? 

If I disable or uninstall the browser extension, the regular CMD\ autofill works, but often very slowly. Is this an automation script? It seems to fill the fields one character at a time, as if Safari invokes it repeatedly for each character. And sometimes it takes 10 seconds to react - as if, after some time period, the script is removed from memory, and takes some time to be reloaded. Besides being slow and ugly, is this automation actually secure?

Universal Autofill is secure and is designed to only fill your logins into code-signed applications using official macOS APIs and integrations.

Does the slowness only happen if 1Password is locked when you invoke Universal Autofill (Command-Backslash)? Or does it also happen when 1Password is already unlocked? Does the issue happen on every website or just some websites? 

Back in the 1PW7 days, 1Password stated there would never be a browser extension per se, just the app extension, because Apple said a browser extension couldn't do the job and wouldn't be secure. How has that changed? 

I'm not sure what you're referring to, can you link me to the statement that you saw so that I can take a look? 1Password 7 came with a browser extension for Safari included with the app.

The current browser extension, 1Password for Safari, uses web extension technology that's used by all modern browsers including Safari. It's not bundled with the app in other to gives customers the choice on whether to also install the desktop app or just use the browser extension by itself. 

Unlike in 1PW7, Safari warns for both 1PW extensions that they can read and alter web pages.

1Password 7's Safari extension required similar permissions: 

The 1Password extension requires access to your browsing history in order to know which website you're visiting so that it knows which login item to suggest. Without this permission 1Password for Safari would have no way to know which login item to suggest and fill/save. You can read more about browser permissions here: About 1Password browser permissions

We do not save or transmit your browsing history and gathering information about you is not our business model. Your browsing history is not collected by 1Password for Safari nor is it ever transmitted off of your device by 1Password. You can read more about our commitment to your privacy in our Privacy Policy: About 1Password and your privacy

The browser extension still offers very little help for most of the settings. Why have you never given a "?" link, or pop-up help, or more text under every setting, or a direct link to a specific web page that explains each option of the settings on a particular tab? Nor have I ever found a set of well-organized page on your web site. It seems that though you made the Safari browser extension the main way to interact with 1PW, it's been left as a weird afterthought, with a bunch of ill-defined options that aren't explained anywhere. One example: What are the differences between "Offer to save and fill logins and other items", "Offer to save items in autofill suggestions", "Offer to save logins", "Offer to save contact information" etc.? There are so many overlaps that are completely unexplained and I just don't understand the effect of these different options.

I'm sorry for the lack of descriptions, you're right that these could be better documented and I'll share this with the team internally. I'll explain what these options mean below: 

• Offer to save and fill logins and other items: This is a general switch to turn off all filling and saving suggestions in the browser. 
• Offer to save items in autofill suggestions: This turns off the "Save in 1Password" button that appears underneath suggestion below a username or password field on a webpage. 
• Offer to save logins and Offer to save contact information: This turns off autosave prompts from appearing in the top right corner of your browser after you sign in to a website using credentials (or if you enter identity/address information) that aren't already saved in 1Password. 
  
  

After generating an updated password, you offer to save the password before the site itself has actually accepted the password.

This is done by design to prevent the password from being lost after the website reloads the page. If you're using the smart password generator, 1Password will try to guess a compatible password for the website. But if the website does reject the password then you can generate a new password and update your saved item in 1Password. 

-Dave

#24063
#36567