android icon indicating copy to clipboard operation
android copied to clipboard

[UX] Registration view seemingly incompatible with password managers

Open webknjaz opened this issue 9 months ago • 20 comments

Home Assistant Android app version(s):

2025.5.3-full

Android version(s):

15

Device model(s):

OnePlus 12

Home Assistant version:

Whatever's on a newly acquired Home Assistant Green (irrelevant)

Last working Home Assistant release (if known):

N/A

Description of problem, include YAML if issue is related to notifications:

In the initial registration flow, the app does not let me use a password manager. Normally, other apps would be happy to prompt me to use Bitwarden and I'd create a login entry in it that would save the app identifier and I'd generate the password and auto-fill most of the fields.

To work around this, I attempted generating a password in a separately opened Bitwarden app and copying it over.

This is suboptimal but is typically possible with password fields in other app. But doesn't work in this one.

The hack I resorted to was clicking on the 👁️ button that turns that field into text and that allowed me to actually paste it in.

Typing it in manually (and twice!) would've been a nightmare for a 128-char password.

So that's an area of improvement. On a related note, I wonder if it'd be at all possible to support passkeys that tend to have quite a seamless UX...

Companion App Logs:

N/A

Screenshot or video of problem:

I don't really know how to record screen to properly demo this one. See the above details.

Additional information:

N/A

webknjaz avatar May 25 '25 21:05 webknjaz

In #5359, @jpelgrom said that this specific screen is a web view from the frontend repo. However, I'm seeing the same password field problem on other views, like typing in passwords for discovered devices (Settings -> Devices and services -> Discovered). Because it seems to affect OS-level behavior, it seems to me like the this issue probably still belongs in here.

webknjaz avatar May 26 '25 12:05 webknjaz

Settings -> Devices and services -> Discovered).

This is still not an app controlled screen. This is from the HA frontend.

dshokouhi avatar May 26 '25 13:05 dshokouhi

Okay, but could it be that the app configures the web view globally not to allow pasting into the password fields?

webknjaz avatar May 26 '25 13:05 webknjaz

Do you see the same issue using chrome for Android on the same device?

dshokouhi avatar May 26 '25 14:05 dshokouhi

Do you see the same issue using chrome for Android on the same device?

No issue in Chrome on the same phone. Auto-filling the password fields through same Bitwarden app is auto-suggested. While the mobile app view doesn't seem to allow completion in the username fields too, not just password fields.

So this is definitely scoped to the Android app.

webknjaz avatar May 27 '25 00:05 webknjaz

Although the issue may only exist in the app we still don't build that screen. It is served by the HA server. All of the screens mentioned so far are not app provided. So they can only be fixed by the HA frontend in majority of cases

dshokouhi avatar May 27 '25 00:05 dshokouhi

@dshokouhi I don't understand how that's possible. It seems like the app is somehow blocking certain interactions with any webviews in it. Could that be an explanation?

webknjaz avatar May 27 '25 09:05 webknjaz

The app won't block interactions, but it seems like Android doesn't want to recognize the password fields in the WebView. Not sure there is a lot the app can do about that, as the system automagically detects when to use it and the app can only add hints for normal Android views.

jpelgrom avatar May 27 '25 09:05 jpelgrom

@jpelgrom it's a bit more than that, though: it wouldn't even let me paste manually copied text into those fields — the context menu doesn't have the Paste option unless I click on the eye button which makes it a regular input, it seems.

Are you saying that it's a built-in Android limitation with webviews? I wish I knew which apps on my phone are built with those to try it out, but I can't remember any behaving like this so far. Also, any web browser is technically a thing with a web view and they don't have this problem. So there must be something, maybe a flag to let the OS know to pass things through.. 🤔

webknjaz avatar May 29 '25 05:05 webknjaz

Some googling suggests that APIs / webview defaults might have changed over the past year or two. They mention enabling JS and the AutofillManager API: https://medium.com/@python-javascript-php-html-css/troubleshooting-password-autofill-issues-in-android-webview-a69a1aade1ce

webknjaz avatar May 29 '25 06:05 webknjaz

Looks like there are documented cases for when it wouldn't work:

Screenshot_2025-05-29-08-15-46-28_40deb401b9ffe8e1df2f1cc5ba480b12.jpg

https://developer.android.com/reference/android/webkit/WebView

webknjaz avatar May 29 '25 06:05 webknjaz

#4973 claims to fix autofill

webknjaz avatar May 29 '25 06:05 webknjaz

The PR you're liking is one specific flow, login (where, anecdotally, autofill works consistently with recent HA versions). Your issue is more general.

jpelgrom avatar May 29 '25 06:05 jpelgrom

Some googling suggests that APIs / webview defaults might have changed over the past year or two. They mention enabling JS and the AutofillManager API: https://medium.com/@python-javascript-php-html-css/troubleshooting-password-autofill-issues-in-android-webview-a69a1aade1ce

It could be use not only for the login by the frontend but also for filling other sensitive information for instance credentials in the integration page.

The best approach IMO would be to have an external bus message that would notify the app that it needs to query autofill api.

TimoPtr avatar May 29 '25 06:05 TimoPtr

The PR you're liking is one specific flow, login (where, anecdotally, autofill works consistently with recent HA versions). Your issue is more general.

I just logged out and double-checked that the login flow doesn't let me use autofill in the android app. It however, did let me paste the password from Bitwarden while the integration pages to not even let me do that.

webknjaz avatar May 29 '25 08:05 webknjaz

I just logged out and double-checked that the login flow doesn't let me use autofill in the android app.

Checked again today at a multiple moments, worked 9/9 times. It comes up with a suggestion the moment I touch the username field. I wonder if how well it works is related to the app performing autofill? I'm using 1Password.

Image

Okay, but could it be that the app configures the web view globally not to allow pasting into the password fields?

Pasting in password fields is also definitely allowed and possible in the app, note the 'Paste' option and the keyboard suggestion showing pasting a password:

Image

it needs to query autofill api

Considering what I mention above, that still may not work all times. Maybe a good first step would be: adding an option to trigger AutofillManager.requestAutofill to the long press menu? That wouldn't require frontend changes and makes it easy to see if it would work at all for this issue.

would be to have an external bus message

Registration is before there is an external bus, similar to login.

jpelgrom avatar May 29 '25 17:05 jpelgrom

I wonder if how well it works is related to the app performing autofill? I'm using 1Password.

That's an interesting suggestion. Though, I'm expecting that it'd hit Android first and that's what displays the autofill on long-press and notifies the keyboard, I imagine.

I changed the autofill settings in the system to the Google-native one, and it still doesn't do anything. Pasting seems to work in integrations if I copy something from the app, like the login field. Maybe Bitwarden was blocking pastes copied from it. But it's still weird not to have that autofill and the keyboard not understanding it should at least prompt me to open BW. It just hides the suggestion bar.

I wonder if anybody with a OnePlus could attempt to repro. Could it be (partially) a bug in their fork of Android? OTOH, it still doesn't make sense that there are apps where it works.

Does anybody know of any other app on Google Play Store that's definitely web view-based? I'd like to check autocompletion against something else...

webknjaz avatar May 29 '25 18:05 webknjaz

Autofill is not suggested for me with a Samsung Galaxy S25 Ultra and 1Password in the Home Assistant android app. I do have the ability to paste with a long-press. Autofill is offered when visiting from the Google Chrome app.

I am trying out Home Assistant for the first time so user error is certainly a possibility.

Image Image

ukanuk avatar Jun 08 '25 20:06 ukanuk