vanadium keeps automatically loggin in despite auto login is toggled off

Onlyfun

anybody else experiences such issue?

de0u

Onlyfun To which web site(s)?

Many sites store a cookie in the browser instead of relying on passwords stored in the browser. That is not controlled by that toggle.

Onlyfun

de0u to all websites actually, this one being as example as follows https://discuss.grapheneos.org/

i am aware of cookies but my issue is not explained by them, appreciate your input though.

de0u

Onlyfun This web site (discuss.grapheneos.org) uses login cookies, not passwords stored by the browser. So turning off the "Auto sign-in" toggle in Vanadium's "Password manager" setting is not expected to log you out from this web site, because the password manager is not logging you in to this web site.

If by "auto login is toggled off" you mean something other than the "Auto sign-in" toggle in Vanadium's "Password manager" setting, can you indicate exactly what is meant by "auto login is toggled off", perhaps via a screen shot?

Onlyfun

de0u man with all respect i clearly said is not cookies.

but if you insist here you go

in Vanadium window press three-dot menu the top right corner, in the dropdown press on the fourth line "delete browsing data" in the pop-up press on the second line saying "last 15 minutes" and press on the bottom line of the dropdown saying "all time". also in "more options" i make sure everything besides "saved passwords" is checked. then i press "delete data".

after that all tabs in vanadium close, and i am facing a blank window with blank search/address/app bar.

then again i press the three-dot menu in top right corner scroll down yo settings, go there and press the fifth line "password manager", there i make sure the second line that says "auto sign-in" is UN-toggled.

then in the top search bar i type graphene os discuss, duckduckgo spits out some search results i press on the first one which takes me to this forum there in the
top left corner menu i press sign-in get the window asking me for credentials, after focusing the input on either line vanadium pops up and offer of a username with password i press on the one i want(i have 2 accounts on this forum, credentials for both saved in vanadium) the username and password are fill-in the forums credential lines and then without me pressing the confirmation (sign-in) button i am being signed in to this forum

I'll try some file sharers to show a screen record of this happening.

de0u

Onlyfun i press sign-in get the window asking me for credentials, after focusing the input on either line vanadium pops up and offer of a username with password i press on the one i want(i have 2 accounts on this forum, credentials for both saved in vanadium) the username and password are fill-in the forums credential lines and then without me pressing the confirmation (sign-in) button i am being signed in to this forum

It sounds as if the toggle may be doing what is advertised: instead of picking a username and password and logging in to the site automatically, it is prompting you, so that if you don't pick one of the saved username/password pairs you will not be logged in.

Here is official documentation on the Chrome feature:

Neither text explicitly says exactly what form the user's verification/confirmation takes. It doesn't say that the browser will fill in the credentials and stop; it just says it won't log in without a user action.

The language could be much more explicit about how the feature interacts with the user, but it's not clear the behavior described conflicts with the documentation.

Onlyfun

here is screenshot you asked
https://ibb.co/RHcF1GH

flighty_sloth

de0u I think this is correct because I have always unchecked auto login and it's always worked this way for me.

Onlyfun

de0u man i got a feeling that you are trolling this post no offense or anything but please dont, its not that much fun think about it instead of replying to my inquiries they are little sense at this point.

someone with true knowledge of this issue please clarify specially somebody graphene os team related as i see it actually a development concern.

DeletedUser87

Onlyfun the toggle does nothing for me. From what I've read it's used specifically for Google sites (if you visit GMail in your browser you would be logged in already via your on-device account). I think other sites can't really do anything with it. If you don't want the current behavior, you need to "lose focus" of the credential picker by tapping somewhere on the screen which will bring up inline autofill on the keyboard (if that keyboard supports it). What you described above can be recreated, so I don't see an issue here.

other8026

Can you give specific examples of which sites are you getting logged into automatically? And would you be able to tell us how you created the accounts? Did you create these accounts with Google (using one of those sign on with Google buttons), or are they accounts you created manually? This kind of information might help figure out what the issue is here.

Also, if you don't mind losing bookmarks (since I see you cleared all history), you can clear Vanadium's storage from Settings > Apps > All apps > Vanadium > Storage & cache. Maybe that'll help?

Onlyfun

other8026 i appreciate your response!

specific sites are all sites actually! literally any site, including this forum. i do not have a google account and never logged in to any google account on this device and few previous devices ever. the one and only piece of software that is somewhat related to google on my device is Aurora Store and couple apps from it that do not requires any google related dependencies and don't even have an option to login and Newpipe to which i do not login either.

well obviously if i clear the storage it will erase the passwords from vanadium and then of course the issue will be gone since it wont offer me credentials at sign-in pages anymore.

this suggestion doesn't make much sense to be honest i think you realize that not less than me, still if it helps i did and of course now without ANY passwords saved in vanadium i dont get automatically signed-in. now i simply copy the credentials from a separate app and paste them in the website fields accordingly.

but there is something that might be related to the issue. you let me know. in stock vanadium there is no prompt to save credentials when i sign in to any site, to make it happen i need to switch to "google autofill" from "third party autofill siervice" in vanadium > settings > autofill services.
let me know pls.

Onlyfun

other8026 hold on, why does the setting description say that its using Google password manager? can you elaborate on this please or link to documentation on this?

DeletedUser87

Onlyfun in stock vanadium there is no prompt to save credentials when i sign in to any site, to make it happen i need to switch to "google autofill" from "third party autofill siervice" in vanadium > settings > autofill services.

and about that part - of course that makes sense. If you don't have a 3rd party password manager (Bitwarden, 1Password, KeePass, etc.) installed, there won't be a prompt. The autofill framework automatically defaults to whatever you set in the browser settings. For system-wide autofill (in apps) you would usually set the Google Passwords (or whatever it's called) as the default in the system settings. If you are not using a dedicated password manager yet, I would highly recommend it. It's actually the best way to save passwords.
The recommendations usually go either in the direction of KeePassDX for local offline password saving or Bitwarden/Vaultwarden if you want to have sync with other devices (Vaultwarden will require a selfhosted instance).

DeletedUser87

Onlyfun because, as I already hinted at that, Vanadium uses Chromium as the base line which uses the Google built-in password manager (Google develops Chromium). You're going to see that description, but it could also say "Vanadium" instead, it's just wording.

Onlyfun

DeletedUser87 i see, thank you for confirming.

Onlyfun

DeletedUser87

DeletedUser87 If you don't have a 3rd party password manager (Bitwarden, 1Password, KeePass, etc.) installed, there won't be a prompt.

i actually do, its keepass. regardless while in Vanadium prompts from keepass to save a pw were delayed so much that i never realized they were related to me actually signing-in to some site as i was already on a different screen. now Cromite as i just tested does get those prompts in a timely manner, but right after i updated it and no more prompts. now the only way for me to have convenient credentials autofilling in Vanadium is to switch to "Google" pw manager, and in Cromite to toggle off the native android autofill.

Imo of course using an third party autofill like keepass os more practical. bavk in days on an s20 i had it this way, but with switch to GOS that flawless keepass implementation disappeared, i was always under impression that it a consequence of hardened app sandbox (my knowledge of how this works is close to zero). but this discrepancy of the wording for the Auto sign-in toggle with my UX always brought up a question in my head. and differences of wording for same things between similar(if not analogs) apps like Cromite and Vanadium only added questions.

DeletedUser87

Onlyfun are you using Keepass2Android or KeePassDX? The former seems to be outdated and kind of unmaintained. I wouldn't rely on K2A to work properly.

Onlyfun

DeletedUser87 really? i use keepassdx. i thought it's weird no updates for a while but didn't know its that bad, thank you for this valuable input, ill look into it and switch asap. and hopefully that will straighten up its aitofill functionality!

DeletedUser87

Onlyfun no, KeePassDX is the more up-to-date one. Switching to Keepass2Android would make no sense. KeePassDX should actually work fine, I don't know how the prompts could be delayed (I myself use Bitwarden, so I have no first hand experience). You might want to clear cache for KeePassDX, that might help.

Onlyfun

DeletedUser87 oh yes, i confused your comment a little. Actually this issue is only a part of the autofill /spelling service i am not sure which one of them is dominating in system hierarchy please correct me if i got it wrong. Let me put it in a nice easy read in case if someone has similar questions.

So i noticed the Vanadium's PW manager auto sign-in toggle mystery a while ago, before i asked for help here. and while following users advises for mitigation or advises to test related functionality i immediately noticed some changes in functions that i never thought are related.
Such as spell checking, corrections , i had mine only recently straightened out and starting the auto sign-in investigation spelling suddenly broke. later it made sense, i figured "Suggesting" is a point of there relativeness.

I am a fan of florisboard keyboard for many reasons, and was always in pain from their spelling ~~support~~ lacking. And recently while submitting some issue on git, another user advised me to try another keyboard that they stated has spelling intact i shacked it out and fell in love, spelling turned out not being able to piss me off most unctions seemed at par with florisboard the font i like actually eben better than florisboard's. but short was my party. i found out that it's clipboard is system-wide fully shared (and no setting to adjust this)vs florisboard's clipboard having options to be accessible only for the florisboard itself or be connected with system clipboard offering flexible results, in few even a single reason for concern a few years I'm on it since 2020 for sure, prob earlier.

This fact gave me next task, that got resolved somehow easily on the go, to have both benefits in one package. i accidentally came across an option in settings to set that suggested keyboard as a spelling service for florisboard. This happened during my trial and error research of Google or third party autofill devices being set in Vanadium