Chris Karlof [:ckarlof] Reporter
	Description • 10 years ago

When a user resets her password, it's often because she forgot it. If we don't work properly to help her remember her new password, it can be a big disappointment. 

Password reset flows are unique. First, it usually involves some separate verification step (e.g., challenge questions, email verification). Then the user often chooses her new password on a page where we doesn't re-enter her username.

Some of the challenges:

* We likely need to associate the new password with a username, so we need some alternate mechanism for the user to provide it, or we need to guess it.
* Sometimes when a "lone password" field appears, the user will want us to fill it (i.e., she is not in a password reset flow, but some re-authentication step), so we need some way to distinguish these two cases (login vs. reset), or at the very least, don't screw things up too badly.

	Alexander Jones
	Comment 1 • 9 years ago

Related to 1164798: 

The password manager should probably not fill out password fields in the absence of a username field of some sort. 

In particular if the password has a username associated with it for a website, and no field is present to place that username in on a page requesting a password, the first password field should not be autofilled.

In a case where your password is required to change your password, this makes anyone with physical access to that machine able to change the password for a user, save the change, and then log in from a different machine without the knowledge of the user who has saved their password in firefox.

	Chris Karlof [:ckarlof] Reporter
	Comment 2 • 9 years ago

> The password manager should probably not fill out password fields in the absence of a username field of some sort. 


FWIW, the fact that it does fill out lone password fields lets us work at all on two stage logins such as BofA, Vanguard, and other financial sites.

	Alexander Jones
	Comment 3 • 9 years ago

I'm sure the answer's not as simple as only having the password manager auto-complete when a single password input is detected on the page, but I'm going to state it just in-case it is.

Would it be possible to honor autocomplete='off' when there are multiple inputs with a password type on the page?