kee-org / keefox Goto Github PK

When I use !KeeFox to log into certain sites, such as Facebook, !KeeFox wrongly believes that the form details as submitted mismatch the form details as saved, and asks me whether I want to save them accordingly.

This occurs with !KeeFox 0.71, Windows Vista Business 32-bit SP2, Firefox 3.5.7, and lots of extensions.

Attaching a log from the Javascript Console, showing the messages KF output during one session immediately after logging in and before the page finished loading.

See [https://sourceforge.net/apps/phpbb/keefox/viewtopic.php?f=1&t=2] for possible further discussion.

After upgrading from the 0.71 development snapshot to the 0.72 snapshot, none of KeeFox's filling works on any forms at all, whether automatic or manually-triggered. I believe this is because the KeeICE plugin is still at version 0.7.0.0; apparently there is no upgrade code to update the plugin.

Will try uninstalling and reinstalling in an attempt to trigger the install code, or perhaps simply toggle {{{[email protected]}}}

KeeFox currently opens the most recently seen database which works well most of the time. However, in some situations the user may want to always start with the same database.

KeeFox should have an option to choose a specific database, regardless of the one that was active when KeePass last locked itself or closed.

The AutoExec KeePass plugin is one example that would work better with KeeFox if it had this new feature.

User can already opt to auto-submit any automatically matched logins when a web page loads.

This may not be ideal behaviour for two reasons:

1. Some websites send you to the login page after you have logged out so you will never be able to log out
2. Some people may prefer to visually verify that the correct login has been chosen before submitting (especially if they have more than one login for that website)

On sites where Keypass has the URL and login info, but you have not logged in, there is a redraw issue with the KeyFox toolbar (hard to explain ... see attachment).

KeeFox should optionally honor the autocomplete attribute in forms, as Firefox does. I used some Greasemonkey scripts to alter this attribute in order to tell Firefox when to ask to remember the password and when not, but now that I use KeePass, this is inefficient, as KeeFox always asks.

For the work/home crowd. Instead of maintaining 2 different databases, I keep them all in 1. However, I do run 2 separate portable FF installs. They each run a plugin that modifies the titlebar to add "-work" or "-home".

So KeePass knows what info to submit because I make 2 instances, and modify the Target Window in the Auto-type tab to look for either "-work" or "-home". Works like a dream, and is why I use KeePass.

KeeFox already checks a bunch of things in the webpage. Can it check the actual titlebar that FF is using? I think currently it must check/pull it from the webpage itself, because when I use KeeFox to save a webpage like "Google -work", the resulting entry is simply "Google".

Automatic form completion and submission chooses which form to fill in based on a number of criteria. It is probably possible that a malicious web site could create a form which attracts KeeFox to populate it with login data. It would benefit the user if a security warning could be raised before such a form submission is permitted.
This warning should be linked to a prompt advising the user to update their stored login details (e.g. the website forms have changed since users last visit)

We could have an option to require matching query string (in GET form) too.

Allow a way to configure the outbound communications timeout from KeeFox to KeeICE.

Note that the brief delay while KeeFox tries to connect to KeeICE while KeeICE is not running is usually not a timeout so changing this value will not affect that aspect of communication timing.

Similar to Firefox's default manager, I think it would be useful to add exceptions that never remember your login/password. That way you would not be nagged by the KeeFox notification bar whenever you visit those sites. Like Firefox, I think you should also be able to view and edit those exceptions in case of an inadvertent (or hasty) button press.

Use case: New accounts will be easier to create and/or more secure if the user has easy access to a strong password generator.

When visiting a site with saved login/password information in Firefox 3.5.7 (might be other versions too), the key icon with the site name to the right starts shifting to the right while displaying small 'blocks' every second or so. Restarting both Keepass and Firefox did not remedy the issue. I experience the issue in on both Windows 7 and XP.

Norton File Insight, part of Norton Internet Security 2010, has flagged my installed version of KeeFox v 0.71 as a risk, calling KeeFox.dll a "WS.Reputation.1". Would you be able to check with Norton about this?

In case it helps, here's a link to Norton's page to dispute it:

https://submit.symantec.com/dispute/insight/

I have flagged this as "major", but this is because Norton is asking me to restart, after which I'm assuming it will block KeeFox from running. Feel free to adjust.

Here is the text from Norton's log entry:

c:\users[Username]\appdata\roaming\mozilla\firefox\profiles[FFProfile]\extensions\chris.tomlinson@keefox\components\keefox.dll

On computer as of
16/01/2010 at 10:04:59 AM
Last Used:
07/05/2010 at 5:37:46 PM
Startup Item: No
Launched: No

Very Few Users
Fewer than 10 users in the Norton Community have used this file.

Medium
This file risk is medium.

Threat Details
There are many indications that this file is untrustworthy and therefore not safe

Origin

Downloaded from Not Available

URL Not Available
UNTESTED

Source
updater.exeFile Created:
firefox.exeFile Created:
keefox.dll

File Actions
Loaded process: c:\users[Username]\appdata\roaming\mozilla\firefox\profiles[FFProfile]\extensions\chris.tomlinson@keefox\components\KeeFox.dll
Restart Required

File Thumbprint:
Not Available

Some problematic sites (Example: What's Up Gold) do not like the "{ENTERFORM}", "{SUBMIT}", or "{CLICK}" form submission commands. Allow a custom field to allow a checkbox for either "default" submisson command or custom, this site required "{TAB} "

Thanks,

Matt Wilson

Use case: Some advanced KeePass users may prefer to follow the KeePass save methodology whereby all data changes are only actually saved when the save button in KeePass is clicked.

When I use !KeeFox to log into certain sites, such as Facebook, !KeeFox wrongly believes that the form details as submitted mismatch the form details as saved, and asks me whether I want to save them accordingly.

This occurs with !KeeFox 0.71, Windows Vista Business 32-bit SP2, Firefox 3.5.7, and lots of extensions.

Attaching a log from the Javascript Console, showing the messages KF output during one session immediately after logging in and before the page finished loading.

The connection between Firefox and KeePass is currently established by Firefox continuously attempting to connect to the KeeICE plugin in KeePass. This doesn't seem to cause any noticeable problems so is OK but it might be neater to allow a way for KeePass to notify Firefox when it has started. It may be possible to achieve this by passing a command line parameter to Firefox as per this MDC article:

https://developer.mozilla.org/en/Chrome/Command_Line

Moving toolbar buttons or changing settings such as the icon size or text display can cause the buttons to revert to an initialisation state ("Loading KeeFox, please wait").

This can be worked around by logging into your database in KeePass again. Other workarounds may include switching databases from the KeeFox menu, moving the buttons again or restarting KeePass.

Use case: When browsing the list of logins (in Firefox or KeePass) the user may identify their desired site more quickly if we can display its favicon. KeeFox could download this automatically when a new login is saved or modified.

I have a few websites I use that have the same back-end authentication mechamism, but show up to KeeFox as different sites. When I change that common password, it'd be nice to change it in one KeePass entry, and have KeeFox pick up on the change for all of the sites.

from prroots:
When KeeFox finds multiple URLs that match it provides a pull down menu so user can select the desired one. That is good. I recommend that when there's only one match the drop down arrow is eliminated. I can't always remember whether or not I have multiple URLs and the arrow causes needless confusion and wasted effort. This is a small detail, but perhaps can be considered in a future update.

Use case: advanced users may have more than one password entry for any given website and may want to specify the preferred (e.g. auto-filled) password rather than relying on the default ordering.

Use case: User may only ever log in to an intranet site using password from their work database and twitter account using only their personal database. It would be nice to let them configure an automatic database choice.

When I use auto-submit on a MediaWiki login form (usually by clicking the login button on a form after unlocking the database), KeeFox will click the button to send a password reset email, instead of clicking the Submit button as it should. (Priority is minor because the password is not immediately reset; there is only an opportunity to reset it, and the previous password still works.)

I haven't yet looked to see exactly what's going wrong; perhaps MediaWiki puts the buttons in the wrong order or something, but at any rate, KeeFox is not handling it very well.

Example sites:

• [http://en.wikipedia.org/w/index.php?title=Special:UserLogin Wikipedia]
• [http://wiki.mozilla.org/index.php?title=Special:UserLogin Mozilla Wiki]

Closing KeePass without first closing your database (or locking it) can cause KeeFox to fail to notice that KeePass has been closed until 10 seconds have passed. If you shut down Firefox during this time it may continue running for a short while with 100% CPU usage, potentially preventing an immediate restart of Firefox.

This is due to the way that KeeFox communicates with KeePassRPC and I hope to improve most relevant aspects of this communication before 0.9 is released.

So far I've only seen this behaviour on Windows 7 with .Net 3.5 SP1. If anyone spots this on their machine, please let me know your O/S, browser version and .NET version.

Some people may want to manage the creation of their passwords entirely through KeePass (or only on a different machine) so this option will streamline their KeeFox experience.

Hi,

I checked the option "Submit forms automatically when a matching password is found". This works very nice as long as there is only 1 Keepass entry matching the URL.

I have 3 Gmail accounts.
When I go to the gmail login page, Keefox automatically logs in with one of the accounts. Even if I log out, it logs automatically in again. There is no way to select an other gmail account = keepass entry.
The only way out is to disable this option, which I don't want.

I think this is wrong. When multiple keepass entries match an URL, the automatically login should be disabled. One should select the desired on from the dropdown box.

Keefox keeps indicating Keepass is not running. When click on the button to "Load my password database (Launch KeePass) nothing changes.
See photos. The second photo is from the Firefox error console which indicates
Error: this._KeeFoxXPCOMobj is null
Source File: .../Mozilla/Firefox/Profiles/kw2fpr20.default/extensions/chris.tomlinson@keefox/modules/KF.js
Line: 987

KeePass is version 2.1. The last photo shows the KP plugins (most of them) which I have loaded.

There is currently an option to automatically submit matched forms (I believe this is optimistic in cases of multiple possible matches, and assumes that the first one in KeeFox ranking is the correct one). It would be very useful to have the ability to mark entries as opted into or out of this auto-submit -- e.g. have the option turned off globally, but have several entries that are known to behave properly opt in to it.

When KeeFox is installed I'm unable to add other KeePass add-ons.

Installing other add-ons generates message:
incompatible with this version of KeePass

http://img294.imageshack.us/img294/6097/keepasspluginerror.jpg

Use case: User has a "Web sites" folder in KeePass and has no interest in other groups.
Use case: User has a "Work" folder in KeePass and has no interest in other groups while using KeeFox at work.

KeyFox inserts the username into the first qty field in the newegg.com shopping cart.

Use case: User has chosen to hide the main toolbar or otherwise can't see it (full screen mode?, Prism?)
Only matched logins will be included by default but all three can be set through options panel

Use case: User wants to automatically switch between work and home database depending upon current location (Firefox 3.5 required)

Please provide support for the middle mouse button, which should open a new tab when clicking an entry in the logins list. Left click should not open a new tab/window, but use the current tab instead.

This is the default behavior in Firefox and the user expects all kind of links to work this way.

I just went to paypal and I see 4 identical history.paypal and 5 identical www.paypal entries. Not very useful. Mousing over and looking at the tooltips gives me the info to make a good choice.

These use a completely different DOM element to other form fields so a bit of extra work is needed to support them. It's mostly already done but a few finishing touches may not be finished by 0.7.

They're not commonly used in login forms so hopefully the impact of their omission from the first beta will not be too significant.

I think there should be three global prefs controlling auto-submit, not just the current two: auto-submit on drop-down select should also exist, and should be defaulted to disabled, I think.

At present, if you click the login button with one entry matched, or if you click one of the entries in the drop-down next to it if more than one matches, KeeFox will auto-fill the form and auto-submit it (by default). However, sometimes KeeFox will get the auto-submit wrong (e.g. clicking the wrong button; see #29 for info), and in such cases it would be nice to have the option to just fill in the fields without submitting.

Use case: Not all KeePass users want to upgrade to version 2.x yet

Unfortunately this is unlikely to happen.

If anyone feels strongly enough to take on this development themselves then just get in touch and I'll make sure you have everything you need to integrate cleanly with the current Firefox add-on.

In brief, you would need to write a KeePass v1 plugin which converts data from an ICE (Internet Communications Engine) IDL class structure and implement all declared methods in that IDL file (called KeeICE.ice if you want to peek in SVN).

Challenges will include mashing the rich data format into KeePass 1.x's limited database structure.

Use case: Mono 2.4 is growing in popularity on a number of Linux distributions, thereby enabling the use of KeePass 2.x on this operating system. It would be nice if KeeFox would work on this OS too.

Key work required is:

1. A compilation of the KeeFox C++ source code for a Linux machine so it can be loaded by the Linux version of Firefox. This may be as simple as running GCC but is likely to require some source code changes.

2. Some parts of the KeeFox add-on may need review (especially w.r.t. directory separators in preference values).

3. An installation routine to assist Linux users with the installation and configuration of required components.

If you right-click a password field, let KeeFox generate a password (and save it of course)

ATTN.: luckyrat

I Can't post at Keefox support forum
https://sourceforge.net/apps/phpbb/keefox/viewforum.php

I get error every time I try to create a post to a thread or create a new thread with firefox AND Google Chrome, here are the error messages I get on both:

Firefox:

The page isn't redirecting properly.

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

*   This problem can sometimes be caused by disabling or refusing to accept cookies.

Google chrome:

This webpage has a redirect loop.

The webpage at https://sourceforge.net/apps/phpbb/keefox/posting.php?mode=reply&f=1&t=5&sid=bf4e45d6f7051e9acb966820b81bc25b has resulted in too many redirects. Clearing your cookies for this site or allowing third-party cookies may fix the problem. If not, it is possibly a server configuration issue and not a problem with your computer.

Here are some suggestions:
Reload this web page later.
Learn more about this problem.

More information on this error:

Below is the original error message

Error 310 (net::ERR_TOO_MANY_REDIRECTS): There were too many redirects.

please send me an email once you fix this, I've got some observations about Keefox I want to post man.

Later.

--duder

Use case: Mono 2.4 can run on Apple Mac computers, thereby enabling the use of KeePass 2.x on this operating system. It would be nice if KeeFox would work on this OS too.

Key work required is:

1. A compilation of the KeeFox C++ source code for a Mac OS.X machine so it can be loaded by the Linux version of Firefox. This may be as simple as running a Mac compiler but is likely to require some source code changes.

2. Some parts of the KeeFox? add-on may need review (especially w.r.t. directory separators in preference values).

3. An installation routine to assist Mac users with the installation and configuration of required components.

I just started using KeeFox and transferred all my FireFox passwords to KeePass. I have 716 entries in KeePass at the moment.

The "Logins" pulldown in pretty much useless. (I haven't moved stuff to categories, just did the import).

KeepPass has a "search" box/feature to manage large password sets. How about something similar for KeeFox. Do the search and then click the user/pass combo you would like.

It would also be nice to have user/pass for the current 2nd level domain available easily.

I think KeeFox/KeePass could become an excellent replacement for the FireFox password store.

When the default option ''"Submit forms automatically when a matching password is found"'' is set, this should be overruled by KeeFox when multiple entries for the same URL are found.

By definition when multiple entries are found, KeeFox can not know for which entry automatic login should be performed.

So when multiple entries are found for an URL, this option should be overruled for that URL automatically by KeeFox.

This has nothing to do with the logout-login loop. That is another issue.

In my case the filename contains Cyrillic characters, which are not correctly displayed at KeeFox toolbar (see attachment).

KeeFox currently records the last database that it was used with. KeePass also records this information (for more than one database file) but they may not always be the same. They either need to be the same or the user needs to have the opportunity to understand and choose between the different options.

I've thought for a while that !KeeFox would be considerably more flexible if certain strange login forms could be handled properly -- e.g. those with three or more fields that must be filled in to log in. Until now, I couldn't think of any way to do this properly, but I suspect that KP's string fields would do the job very nicely -- essentially, match the field name to the labels available on the form and fill in the corresponding with the field value.

Obviously, there are a few tweaks to be made: one possibility is to require that all fields to be auto-filled have names surrounded with e.g. asterisks (*), to reduce accidental entries (this would need testing to make sure it's the best approach). The challenges of correctly matching strangely arranged labels to their fields is certainly not trivial, but that's largely what !KeeFox has to do in any case.

Offhand, I have at least a dozen logins currently that could make good use of this feature, and at least five that absolutely require it to make any use of KF auto-fill at all. I don't know how typical I am, but I suspect many or most KeePass users have at least one login with custom fields.

I have KeePass installed into different location rather than "C:\Program Files". KeePass is running at the moment I install KeeFox addon.

Current behaviour: KeeFox downloads new KeePass installation & installs it.

Expected: KeeFox detects the KeePass location and installs KeePassRPC.plgx plugin to existing KeePass location. If installation failed, ask user to close KeePass and retry [or] extract plugin to some directory and ask the user to install plugin manually.

If KeeFox depends on some particular KeePass version (say, >= v2.12), KeeFox should suggest the user to upgrade, but do not do it automatically.

KeeFox v0.77.