Protect what matters – even after you're gone. Make a plan for your digital legacy today.
Forum Discussion
volts
4 years agoSuper Contributor
Open & Fill mangling URIs - appending query string - garbage or security issue?
Open & Fill is appending garbage query strings to item website URIs.
I created a new Login for this website URI:
https://example.com/blah
Open & Fill launches this URI, with a query-s...
volts
4 years agoSuper Contributor
I may be looking at this wrong, of course. And I look forward to understanding it better. Now I'm just rambling & making assumptions & guesses:
Is there any reason the query-string values are durable? I'm hoping they are generated randomly, not derived from the item's contents or a static ID. It seems like they only need to be valid until the browser sees the address (and could be invalidated), or maybe for a few seconds?
Obviously it would be nice not to pollute the URI with this stuff at all. :-) It's "rude" and ugly and does break some sites. Would it be possible to avoid sending it for items with no "fillable" fields?
Is the mechanism that 1Password 7 used with the Safari extension not viable? I'm guessing it used macOS and Safari-specific stuff and wasn't very portable.
I assumed modern 1Password could use the fancy Rust core to pass messages, even simple data flags like "autofill with this item". I don't have any sense of how frequently the browser plugins communicate with the core, but I assumed it was often, since password changes are detected immediately.