User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0

Steps to reproduce:

I have a domain where I host a bunch of different sites in different subdomains, basically something like:

• myapp1.mydomain.de
• myapp2.mydomain.de
• myapp3.mydomain.de
• etc.

Actual results:

Since a couple of versions, Firefox's password manager offers all logins I ever used on any of those apps in every password form. So I have a huge list of unrelated logins cluttering up the screen, making it tedious to find the correct one (especially since they seem to be in random order, sometimes the right login comes out on the top of the list, but often it's just somewhere in the middle). Also, there are a lot of credentials listed where I don't even know where they came from (e.g. in the screenshot I added, there are 6 credentials listed directly for the site, but I'm relatively sure I never used any of those on that particular page). In total, FF offers me 27 credentials on the screenshot I added, which is just way too much to handle. And like I said, a couple of versions ago, I would only get credentials that actually belonged to the site I'm using, so whatever changed there didn't improve usability

Expected results:

There should be some kind of sanity check or something: If FF sees that there are already 5 or 6 credentials belonging directly to the page, maybe it shouldn't add credentials from other subdomains, or maybe hide them behind a "show more" button or something. What would be even nicer would be if the password manager could behave a bit more like the location bar and just learn over time which credentials are used where. E.g. when I log in to to site1 with username1 49 times out of 50, maybe username1 should be preselected and/or at the top of the list of choices

Meh, looks like I've uploaded a screenshot where the data is not obscured. It's not very critical, but could someone delete the old version of the file? I don't seem to have permissions to do that

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

(In reply to flack from comment #2)

It's not very critical, but could someone delete the old version of the file? I don't seem to have permissions to do that

I have now hidden it so only users with access to security bugs can see it. I can't delete it but if you really want we can ask BMO admins to do so.