LastPass bookmarklet not supported in ubuntu-touch browser

[Matthew Exon]

LastPass offers a bookmarklet feature, a little piece of javascript you can run from the address bar which fills in passwords for you. This is the only convenient way to use a password manager like this on a device that isn't natively supported by their plugins. I used to use this feature all the time on my Nokia N900.

The way it should work is:

* Log in to the LastPass website, and in the "Tools" menu select "Bookmarklets"
* Long press on "LastPass Fill!" and tap "Bookmark link"
* Navigate to a website to log in to
* On the address bar, clear the address and type "lastpass"
* Bookmarklet will be suggested as a bookmark with a star icon (it starts "android:lpfill...")
* Tap that bookmark
* It should execute the javascript and fill in username and password (after authenticating with LastPass)

In fact after tapping the bookmark it does nothing.

[Olivier Tilloy (osomon)]

You mention in the description that the bookmarklet starts with "android:", is that correct?

If so there’s no chance of it being supported in webbrowser-app. Bookmarklets are supposed to start with "javascript:". See bug #1407746 for support of correct bookmarklets.

I’ll keep this bug open though, as I’m curious of this "android:" prefix. I guess you’re getting this because of our default UA string that contains an "android" token. We could experiment with UA overrides for lastpass to see if this gets us a better bookmarklet.

[Matthew Exon (ubuntubugs-mexon)]

Wow, that is interesting. It turns out that using the Ubuntu browser Lastpass's website returns that "android:" string as the bookmarklet, whereas using a normal webbrowser it returns a much longer "javascript:" string. Seems like this is some kind of optimisation introduced on LastPass's end and it's mistakenly identified the Ubuntu browser as an Android browser.

I think this means that if I copied the correct "javascript:" string from my computer into a bookmark, it'd probably work. But I can't figure out how I'd do that. Any suggestions?

Meanwhile I guess I'll complain to LastPass...

[Matthew Exon (ubuntubugs-mexon)]

Ah right, so I just checked my own server logs and the user agent string in the Ubuntu browser is "Mozilla/5.0 (Linux; Ubuntu 14.04 like Android 4.4) AppleWebKit/537.36 Chromium/35.0.1870.2 Mobile Safari/537.36". I don't think I can realistically blame LastPass for treating it like an Android phone!

I'd say that if you don't support "android:"-style links then you're not "like Android 4.4" at all. That's gonna break all kinds of stuff I'll bet.

[Matthew Exon (ubuntubugs-mexon)]

(Also it's kinda late here, I didn't read carefully, and I now realise that all of the above is exactly what you said in your comment. Sorry! I still kinda think that the UA string is a bit misleading though.)

[Olivier Tilloy (osomon)]

The "like Android" token in the default UA string has been the topic of many debates in the past. If you’re interested, see the discussion in bug #1328183.

[Olivier Tilloy (osomon)]

I just looked further into this, and I think we can close the bug as invalid: LastPass has some instructions on how one needs to remove the "android:lpfill?" prefix from the URL when creating a bookmark with it, so this is the expected behaviour:

  « If your mobile device doesn't support copy and paste, there is another method. You can install by selecting the links above. You will arrive at an error page, which is expected. Once there, add a bookmark to the error page. Before saving the bookmark, edit the address field and remove everything up to and including the first question mark ('android;lplogin?', 'android:lpfill?', or 'android:lpformfill?'). Once you're finished, the address field should start with 'javascript:'. »

[Matthew Exon (ubuntubugs-mexon)]

This method doesn't seem to work for me. I select one of the links as instructed. It doesn't generate an error page, rather it just shows a blank page. When I go to the address bar it looks like most of the javascript has been deleted, it just says "ref);document.body.appendChild(_LP_);".

I think the address bar on this browser is too short to accept all that javascript. Only long-pressing on a link and selecting "Bookmark link" works.

So I don't think this bug is ready to be closed as Invalid yet.

There really should be some way of inspecting and manually editing bookmarks, not just adding or removing them. If that was implemented, this bug could be closed.

[Olivier Tilloy (osomon)]

What you’re describing here is a bug in the TextField component used by the browser for the address bar. I verified that the field actually contains the entire URL, despite not allowing to scroll through it (if you long press to show the context menu, then select all, then copy, and paste it into another app, you will see the entire URL).

So a bookmark to that page with a bogus address can be added, however the current UI for bookmarks doesn’t allow editing the URL of a bookmark, so that bookmark cannot be "fixed". I filed bug #1527560 to track this as a more generic issue.