clients
clients copied to clipboard
bitwarden
Invasive when not even in use
When using the Chrome browser extension, when you click on a checkbox on the page the element gets a:
data-com.bitwarden.browser.user-edited="yes"
Attribute added to it.
This page has:
- NO credentials on it (no password input, it's a contact form, not a login form)
- Bitwarden is not in use or been interacted with manually at all.
So my question is, isn't this a bit invasive? Why is Bitwarden seemingly interested in form elements on a page that it should have no business in? It get's me worried.
IMO, Bitwarden should only ever initialise MINIMAL code in order to determine if the page contains a form with credentials. In all other instances, there should be no code or invasive elements or listeners added to the page.
You can view the autofill code that does this here: https://github.com/bitwarden/browser/blob/master/src/content/autofill.js
It even does it when your using something like CodePen:
https://codepen.io/garygreen/pen/aaGBbV
It's pretty ridiculous that it's this invasive.
I agree this is super annoying. I'm developing a website and bitwarden is modifying my html when I haven't even clicked on the bitwarden plugin and the page itself has zero password fields on it.
@kspearrin any news on this? I still find it a bit concerning how much Bitwarden chrome extension interferes with all pages. It should only inject/enable the most minimal amount of code when it needs to, not on every page load.
This leaks the fact that the user is using Bitwarden as their password manager to the server.
Had this just now as well, this is quite a serious issue, especially when using contenteditable.
Because of this, I will restrict only to specific sites.
This leaks the fact that the user is using Bitwarden as their password manager to the server.
How so? Does this not just manipulate data on the DOM, locally?
This leaks the fact that the user is using Bitwarden as their password manager to the server.
How so? Does this not just manipulate data on the DOM, locally?
Yes, that's what it does. And JavaScript running locally can easily detect this and send it to the server.
Hi @garygreen, We're cleaning up our repositories in preparation for a major reorganization. Issues from last year will be marked as stale and closed after two weeks. If you still need help, comment to let us know and we'll look into it. Thanks!
Extension interferes, example here :
Nextcloud extension https://github.com/shiningw/ncdownloader
This issue should still be addressed as it also breaks functionality on some websites. Besides what @emericv posted, when Bitwarden tries to mark a contenteditable input as user-edited, it causes an Index Error. See https://github.com/ueberdosis/tiptap/issues/2697
I'd love for my password manager to not break my websites ✌️
Please fix this! <3
Hi all, thank you for bringing this to our notice; looks like this has been lingering for a while. I'd pass this on to the team and we will make time to take a look!
@dbosompem Do you know if this issue is on any type of roadmap? It causes issues on certain sites for me.
@dbosompem please "take a look". While this is not the most serious issue, it is pretty serious.
Hi all, apologies nearly missed this. Thanks for the callout. I'd have a discussion with the team on when we can resolve this, as we might have to take a look at the autofill script. Apologies for the inconvenience caused and thank you for your patience so far. I'd reply to this thread once there's a known ETA for this fix.
Hi all, apologies nearly missed this. Thanks for the callout. I'd have a discussion with the team on when we can resolve this, as we might have to take a look at the autofill script. Apologies for the inconvenience caused and thank you for your patience so far. I'd reply to this thread once there's a known ETA for this fix.
This would be great! If we could even just blacklist certain sites. That would be great.
@dbosompem I looked at the autofill source code and it doesn't look like the userEdited variable is even used anywhere in the code.
@dbosompem I believe I fixed the issue with #4001 I tested it out and nothing seemed to be broken.
@hkbertoson thank you for the kind consideration. The team will make time and take a look at the PR.