Can you give me an example of a UX problem that you attribute to the password manager? That'd help me understand.
I often hit problems with 1Password's autofill on particular websites, but by and large I blame the website. Few examples:
* one website expects me to type the PIN then a Symantec VIP OTP token into a single field called "password". That's a (possibly deliberately) password manager-hostile design. I finally got annoyed with it enough to use an open source project called `python-vipaccess` to create a proper `otpauth://totp/...` URL I could add into 1Password and wrote a TamperMonkey script that added separate autofillable fields that would get concatenated automatically. Now 1Password works fine.
* frequently websites will complain about needing a valid credit card number after autofill. I have to go to the field, delete the last digit, add it back, tab away, then it works. I think they have just used the wrong event handlers and never tested it with autofill.
* they often will skip `autocomplete="new-password"` attributes, so my password manager will look for a (nonexistent) current password rather than prompting me for a new one, and/or they won't have the username and new password fields ever in the DOM at the same time so the password manager doesn't save it properly. (Even if it makes sense in terms of user-visible flow to do these in sequence, they can still leave the username in as a hidden form element for the benefit of the password manager.)
I've also hit UX problems in 1Password itself, for example the "quick access" pop-up doesn't reliably appear on the current Space in macOS. (Confusing and annoying to have to switch to another to see it.) But they seem less common.
These are tiny paper cuts that add up to pain, like the ones you mentioned that affect me/a tiny portion of the user base so they aren't worth fixing. Is the justification I'm sure that's being made. For example, if site auto detection that you're submitting a form fails that you laboriously have to add field elements in and if the editor is on a different workspace on mac you have to go to the application space/desktop than three finger swipe back to the browser space/desktop and then back to the application space/desktop and then back-and-forth to fill in four different security questions. Tiny stuff like that that really adds up, that make password manager usage go down.
> These are tiny paper cuts that add up to pain, like the ones you mentioned that affect me/a tiny portion of the user base so they aren't worth fixing. Is the justification I'm sure that's being made.
I think it's not only that but also that making site-specific changes (as I did with a TamperMonkey script) is fragile and could get them into trouble if their changes do the wrong thing (immediately for everyone, for some users, or after some site change). Might be better from their perspective to honor the site's stated intent even if that intent is questionable. In my top example, the "password" field actually is a password if the user hasn't enabled 2FA, so the changes I made wouldn't work for 1Password to apply to everyone. They could detect the label "PIN + Token" to gate it, but what if that text changes in a redesign or is sometimes localized into another language? and so on.
In the broadest sense, I agree there are big UX problems, but how much should we expect the password manager to do unilaterally? fwiw even when a bunch of players got together to make broader changes, we ended up with passkeys, which are far from perfect in many ways. (The flows about scanning a QR code from one device to another, without necessarily even knowing which device has a working passkey for that site... the simultaneous confusing offers of different ways of signing in... try talking your vision-impaired father through that over the phone.)
> if the editor is on a different workspace on mac you have to go to the application space/desktop than three finger swipe back to the browser space/desktop and then back to the application space/desktop and then back-and-forth to fill in four different security questions.
Yeah, that sounds similar to my own complaint about quick access opening on the wrong Space, just applied to the main window instead. And of course when you have to use the security questions something else has gone really wrong, like the main password having changed on the site without having changed in your password manager.
* One way I've seen this is when people have overlapped usage in two different password managers (1Password vs either Google Passwords or Apple Passwords). They have import and export (except for passkeys), but it'd be nice if they had an incremental version to help you get out of this mess if you weren't disciplined in switching over all at once.
* Another is that when you change the site's password even while using the password manager, the actual site change and recording it in the password manager's database is hardly transactional. You can click the password manager's update pop-up even if it failed, or not notice it even if it succeeded. Again not really sure how they would address this unilaterally.
> I just hit one. Creating a new document in 1Password, the name of the document isn't preselected, so I have to hit delete to name it. Lots of little tiny shit like that.
I can't expect them to serve every website on the Internet, but a button on 1Password that was in the context menu for the extension that was "report this site is not working 100% perfectly", and they had a team to come in and check up on the site and extract way to improve their software.
I remember another stupid annoyance. There was one site where passwords were limited to eight characters but the way they password manager entered the passwords. It passed more than the characters along as the password so the password would fail if it auto filled, but if I copy and pasted or typed it manually it would work because the JavaScript had a chance to truncate. The fact that this site was limited to eight character passwords all other conversation, but that was super annoying until I figured it out.
Anyway. I have a love/hate relationship with my password manager.
(I'm Mitch from 1Password.) I do appreciate reading about these kinds of paper cuts and always follow up on them when I see them. We are going to address the item title issue next week, so thank you for that one.
It's true that sometimes very small/simple issues that affect some portiion of people can go for a long time. I'd like to find a better way of identifying these and getting to them quicker than just crawling through HN posts. If you have any thoughts or at least issues you'd like us to look into, always open to hear more.
I just hit one. Creating a new document in 1Password, the name of the document isn't preselected, so I have to hit delete to name it. Lots of little tiny shit like that.
Thanks for the feedback. It's certainly a challenge to make 1Password work on every website that exists, and even more so to keep it working over time, especially with old items that people created years ago which no longer match the site. We do have a whole "filling and saving" team dedicated to the problem, and we do follow up when users report issues with sites.
I'd love to look into the Quick Access placement. It is supposed to appear on all spaces and sets an NSWindow property to do so. Is there anything particular that you think triggers it (multi-monitor, full screen apps, etc)?
> I'd love to look into the Quick Access placement. It is supposed to appear on all spaces and sets an NSWindow property to do so. Is there anything particular that you think triggers it (multi-monitor, full screen apps, etc)?
Thanks! I haven't seen it in a while, so maybe it's been fixed by either a 1Password or macOS update or is specific to a setting I since changed. But I'll keep my eyes out for if it happens again. I do have a multi-monitor setup.
I do see right now that if I'm on a full-screen app, 1Password's quick access window doesn't show up; if I move to the next space over I see it for a moment and then it disappears. In contrast, Spotlight search will actually pop up directly over my full-screen app, though knowing Apple they could be using some private API for this behavior.
I often hit problems with 1Password's autofill on particular websites, but by and large I blame the website. Few examples:
* one website expects me to type the PIN then a Symantec VIP OTP token into a single field called "password". That's a (possibly deliberately) password manager-hostile design. I finally got annoyed with it enough to use an open source project called `python-vipaccess` to create a proper `otpauth://totp/...` URL I could add into 1Password and wrote a TamperMonkey script that added separate autofillable fields that would get concatenated automatically. Now 1Password works fine.
* frequently websites will complain about needing a valid credit card number after autofill. I have to go to the field, delete the last digit, add it back, tab away, then it works. I think they have just used the wrong event handlers and never tested it with autofill.
* they often will skip `autocomplete="new-password"` attributes, so my password manager will look for a (nonexistent) current password rather than prompting me for a new one, and/or they won't have the username and new password fields ever in the DOM at the same time so the password manager doesn't save it properly. (Even if it makes sense in terms of user-visible flow to do these in sequence, they can still leave the username in as a hidden form element for the benefit of the password manager.)
I've also hit UX problems in 1Password itself, for example the "quick access" pop-up doesn't reliably appear on the current Space in macOS. (Confusing and annoying to have to switch to another to see it.) But they seem less common.