Implement password sync

[jsecretan]

Problem Description

The iOS browser should sync passwords with Desktop and Android instances of Brave which have the sync feature enabled

Feature Overview

Please refer to the comments for details

1. Implement password sync #3228 (comment)
2. Implement password sync #3228 (comment)

Design

We will be using the Design created for #4124

Implementation Details

Please refer upcoming iOS PR for details and Test Plan

##User Experience

1. Use Desktop or Android version of Brave and save password for a few sites
2. Enable sync
3. Join the sync group from iOS

Additional information

There should be toggles for password on sync screen (on iOS) so user can choose to sync or not sync passwords.

[tsndr]

Will this be implemented any time soon? It's super annoying to not have my passwords on iOS.

[bsclifton]

Hi there @tsndr 😄

Quick update on sync overall; @soner-yuksel is just wrapping up History sync right now with #3703

The other types we'll be looking at are:

• Password (this issue)
• Preferences (no issue created yet)
• Autofill (no ticket created yet; app doesn't really have auto-filling yet as a feature; would need to add and implement)
• Tab sync (app will need some refactoring before we can do this; it's a large scope feature)

Password would be the easiest to grab next. @anthonypkeane can help collect requirements

[tsndr]

Hi @bsclifton,

I appreciate the reply and am looking forward to its implementation and to using Brave again.

[Apraptor]

Hello @bsclifton. Seeing if there’s an update to this. Password sync is one of the last features preventing my switch from chrome. Thanks a bunch!

[lil5]

@jsecretan filling in the issue template is such a small amount of effort and helps show that you actually care about your issue.

[tsndr]

@lil5 Are we making this about formalities now? If you don't care about this issue, just keep it to yourself.

[thebrightestday]

This is a critical feature. People are moving away from your product because of this. It is extremely frustrating not being able to login to any website on iphone/ipad. Basically Brave is unusable on mobile because of this.

[bsclifton]

Hi folks - I updated the original post; thanks for calling that out @lil5. It's good to have clear requirements for what the feature will do.

We are looking at this now - development hasn't started yet. @soner-yuksel has been digging in on the iOS side and @jamesmudgett will help with the design itself. @anthonypkeane has been leading the overall effort as the implementation may allow Brave to be used as a password manager in other applications. I assigned folks to reflect the real status (that it's being worked on)

[michaldepa]

@bsclifton, could you provide a timeline for this feature being released? I echo the sentiment of the others, in that this is a critical feature that significantly detracts from your product. If there is no timeline assigned for this internally at Brave yet, I will unfortunately have to switch to another browser that is more feature complete.

[bsclifton]

@soner-yuksel will be able to give an update here 😄 Good progress has been made actually (maybe we can share screenshots?)

[soner-yuksel]

Hi folks. 

As you might know, we added Sync Profile Types and ability to enable/disable different sync types with our recent History Sync released in 1.30. We also plan to add password as a new sync type, but before we do that we have to revamp some of the existing features, introduce new UI changes and deal with new data format as well as migration from brave-core. Hence, we decided to approach the implementation of the feature in following steps:

Right now, in our existing design we only have “Save Logins” toggle in our Settings and there is no way of seeing saved passwords. As the first step we want to introduce new Passwords & Logins screen. In addition, we want to refine our script that enables us to save and auto-fill login information.

 This week I will provide the details on the UI design change and develop login script that will link the tickets for specific details in the thread.

In short, the password screen will support listing, deleting, updating, searching and actions for the fields (open & fill, copy, reveal). For the improvements in the login script we made changes towards supporting login suggestions where window can be iframe.contentWindow and injecting into iFrame, in addition we worked on XSS (Cross-Site-Scripting) problem where it won’t inject autofill credentials.



Some example screenshot from the potential UI changes.

We are very close to finish these first steps this week and create a PR for it.



In our next ongoing step, we will be working on Password API on brave-core side where we can do our password operations using brave-core which enables us syncing password items. This work is already started and we finished a significant portion. In addition to creating the Password API, this work will also include migration of the existing login-password items and syncing them. When we achieved this there will be possible new alterations to UI where user can save and auto-fill the passwords in different ways.



Finally, we would like to finish this feature by implementing a Password Manager for iOS. This will enable the user to conveniently register Brave as a password manager and use it throughout the system.

[michaldepa]

Thank you @soner-yuksel, I appreciate the thorough response! Do you have any target release date for this feature in the iOS app?

[soner-yuksel]

We dont have any hard set date for the entire release but we are working towards landing it as soon as possible.
Also, like I mentioned above, this feature will land in phases. We will keep the issue up to date and link the tickets created related with this issue here. You can expect first step with script improvements and password screen in upcoming releases.

[bsclifton]

@michaldepa as a safe ballpark (a date that we'll have password sync 100% completely done by) - I'd say we should have this within 2-3 months. Likely sooner 😄 As @soner-yuksel mentioned, we'll land this in phases. For example, adding the new password list screen, fixing/improving the save password prompt, and then finally wiring up the passwords from sync itself to our passwords 😄

[michaldepa]

That sounds great, thanks!

[Apraptor]

Thanks for the update! Once the passwords are synced, do you know if we will be able to use the sync passwords in other apps with the iOS auto-fill password feature, like Chrome does?

[bsclifton]

@Apraptor ah - being able to use Brave as a password manager. We are looking at this! I believe the work to enable this will be separate as it involves getting an entitlement and making specific changes to the app. But we definitely want to do this. Maybe @anthonypkeane can share more details

[ghost]

good morning everyone.

Just checking in... are there any updates on this issue so far ? Is it the only blocker between me and using brave full time.

[iccub]

We will most likely have to delay it a bit, to fix other retention focused things and browser parity items.

@soner-yuksel works on it and should have more insight on how much work is still needed in order to deliver it.

[thebrightestday]

Thanks for the update.

Unfortunately, it seems that the Brave product management team is not realizing how crucial this "simple" functionality is. As I mentioned already, nowadays the average number of devices the user has is not 2 or 3, but 10, that is a fact. Google it. So imagine how frustrating is to have a browser that does not remember your passwords throughout those devices. And we all log in multiple times a day to many websites.

There are many good things in Brave, many. But not having a basic functionality to sync my passwords, really? If you open a certain website on other 9 devices that I mentioned, how do you think the user will log in? Do you understand that this is a pitfall where the user will immediately switch to another/previous browser? Good luck retaining them at this point.

[soner-yuksel]

Let me give a more transparent update about progress including "what are we going to release upcoming version", "what are we working on right now" and "what are we delaying".

• What are we going to release upcoming versions?

We finished the work on implementation of Implement Logins & Passwords Screen. In addition to the UI implementation we are going to release the improvements for LoginsHelper to solve iFrame and Cross-Site-Scripting problem.

Tickets: #4112 #4113
Pull Request: #4124

• What are we working on right now?

We are working actual password sync implementation on brave-core side, this work is mostly finished. In addition to the brave-core side work we are also working migration of existing passwords and changing the iOS code base it will support password operations thorough the new created API. This is taking a while because of the some other obstacles on brave-core side related with sync and refactoring Sync API classes and its mobile implementation.

• What are we delaying?

The much needed improvements on UI while saving and auto-filling the passwords while website is on the screen. These alterations includes changes to UI where user can save and auto-fill the passwords in different ways.



Becoming a Password Manager on iOS. This will allow us to use the passwords saved in Brave on other applications.

I hope this gave a little bit more clarification about the progress.

[ghost]

Thanks for the update.

Unfortunately, it seems that the Brave product management team is not realizing how crucial this "simple" functionality is. As I mentioned already, nowadays the average number of devices the user has is not 2 or 3, but 10, that is a fact. Google it. So imagine how frustrating is to have a browser that does not remember your passwords throughout those devices. And we all log in multiple times a day to many websites.

There are many good things in Brave, many. But not having a basic functionality to sync my passwords, really? If you open a certain website on other 9 devices that I mentioned, how do you think the user will log in? Do you understand that this is a pitfall where the user will immediately switch to another/previous browser? Good luck retaining them at this point.

Totally aggree on this. This basic functionality should be at core of every browser and this no-sense delay is clearly gonna cut the userbase. I am no dev by any means.. but everysingle application i have used on IOS which allowed to synch data across devices.. had this feature at day 1 release.

[ghost]

Thanks for the update.
Unfortunately, it seems that the Brave product management team is not realizing how crucial this "simple" functionality is. As I mentioned already, nowadays the average number of devices the user has is not 2 or 3, but 10, that is a fact. Google it. So imagine how frustrating is to have a browser that does not remember your passwords throughout those devices. And we all log in multiple times a day to many websites.
There are many good things in Brave, many. But not having a basic functionality to sync my passwords, really? If you open a certain website on other 9 devices that I mentioned, how do you think the user will log in? Do you understand that this is a pitfall where the user will immediately switch to another/previous browser? Good luck retaining them at this point.

Totally aggree on this. This basic functionality should be at core of every browser and this no-sense delay is clearly gonna cut the userbase. I am no dev by any means.. but everysingle application i have used on IOS which allowed to synch data across devices.. had this feature at day 1 release.

True just hope a better security than a simple key for password sync.

[Apraptor]

Let me give a more transparent update about progress including "what are we going to release upcoming version", "what are we working on right now" and "what are we delaying".

• What are we going to release upcoming versions?

We finished the work on implementation of Implement Logins & Passwords Screen. In addition to the UI implementation we are going to release the improvements for LoginsHelper to solve iFrame and Cross-Site-Scripting problem.

Tickets: #4112 #4113 Pull Request: #4124

• What are we working on right now?

We are working actual password sync implementation on brave-core side, this work is mostly finished. In addition to the brave-core side work we are also working migration of existing passwords and changing the iOS code base it will support password operations thorough the new created API. This is taking a while because of the some other obstacles on brave-core side related with sync and refactoring Sync API classes and its mobile implementation.

• What are we delaying?

The much needed improvements on UI while saving and auto-filling the passwords while website is on the screen. These alterations includes changes to UI where user can save and auto-fill the passwords in different ways.



Becoming a Password Manager on iOS. This will allow us to use the passwords saved in Brave on other applications.

I hope this gave a little bit more clarification about the progress.

@bsclifton, @soner-yuksel thank you for the update. can't wait for this feature to be released. I can't tell you how many times I'm out and about and find myself unable to access a website because the password is only stored on my desktop. Just being able to sync and access those password on my iOS will already be a huge game changer.

[Samadriae]

If this feature is enabled it will definitely be a game changer for this excellent browser!

[soner-yuksel]

As we mentioned in previous comment #3228 (comment)

We are adding Sync Internals page with 1.36 please let us know your problems with details from internals page so we can pin point the problem. #4560

And like @iccub mentioned, we are close to land the work for password sync and our estimation to deliver it in 1.37 is not changed.

For more details ..

brave-core PR : brave/brave-core#12360
iOS PR: #5013

[Uni-verse]

Verified using version 1.37 (22.3.29.15)

Devices:
iPad (7th Gen) running iPadOS 15.2.1
iPhone 12 Pro running iOS 15.4
iPhone X running iOS 14.4.2

Test Scenarios:

1. Scanning QR code and enabling password sync

• Passwords don’t sync until toggle is enabled.
• Autofills successfully.
• Able to leave sync chain and rejoin join, passwords synced successfully.
• Password sync toggle not enabled by default.
• Syncs both ways.

2. Creating Standalone chain, then joining chain

• Autofills successfully.
• password sync when toggle is enabled.
• Password sync toggle not enabled by default.
• Syncs both ways.

3. Upgrading with Sync Chain

• Password syncs when enabled.
• Adding passwords post upgrade will be added to list.
• Autofills successfully.

Issues: Only enabling the password toggle one way will sync password data.

iPad	iPhone

[iccub]

Hey all, the password sync is out on the latest App Store build :) you may need to go to the app store to update it manually since it's a staged rollout.

Let us know whether it works for you or if there's any problems.

Next sync type in the work queue is Tabs

[Apraptor]

What a great day. Good bye Chrome.

[jayorzee]

Hey all, the password sync is out on the latest App Store build :) you may need to go to the app store to update it manually since it's a staged rollout.

Let us know whether it works for you or if there's any problems.

Next sync type in the work queue is Tabs

Hi Iccub

Thanks! It works. However, I have noticed that if I have two or more logins saved for a particular page it will auto populate one and there is no option to select the other ?

[WizardOfWor1969]

Does not autofill the passwords, continues to use the "Apple system passwords" am I missing something or are you supposed to copy and paste the brave synced passwords manually to login to a site?

[iccub]

what website are you having problems with @WizardOfWor1969?
as far as I know, our JS logic to autofill credentials does not work on every website yet

not great workaround but you can go to the password manager from the Brave settings and copy credentials to your clipboard manually

[iccub]

@jayorzee I think we do not handle this case yet, we plan to show a prompt before credential autofill, I will try to check if there's any design we can think of to allow handling multiple entries

Our long term goal is to reuse more of the chromium's logic when it comes to the password fill,
while we implemented the sync part and you can always copy pwds manually from our password manager,
our UI layer needs to improved further

[0xGREG]

Sites that have multi-step login doesn't work for me, for example Twitter. @iccub

[WizardOfWor1969]

schwab.com does not work. Odysee.com , yewtu.be, most sites for me so far do not work. I think I could only get one to work, and I had to type in the username and the password appeared. atariage.com did work.

[0xGREG]

Honestly I'm just happy that I can even copy out the password. I've been waiting for this for a year.

[mdlaat]

I was happy with password sync for a few days, but today my ipad lost the connection with the sync chain

[eguun]

Unfortunalty that is a well known -and replicable- issue on IOS that is taking way too long to get acknowledged and solved. You could voice your issue there … hopefully this will help raise awareness. https://community.brave.com/t/ios-sync-wont-work-sync-communication-error/289995 The issue has already been shared in this mailing list. Thanks

…

On Tue, 12 Apr 2022 at 11:36, mdlaat ***@***.***> wrote: I was happy with password sync for a few days, but today my ipad lost the connection with the sync chain <https://community.brave.com/t/brave-sync-on-ios-is-completely-broken-and-has-been-for-many-months-plus-other-bugs-with-sync-on-ios-too-ios-if-you-have-ios-please-read/306368/184> — Reply to this email directly, view it on GitHub <#3228 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AS3DOJZSZCPVV6HUBPNL47TVEU72NANCNFSM4WNK4LMA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[martinlanger90]

Since 1.37 my iPad does not sync anything at all. There is just a message "communication error" when trying to sync.

[iccub]

@martinlanger90 can you show us your sync internals page?
Go to the sync settings screen and tap on a cog wheel icon in top right

[martinlanger90]

I tried to clear the sync data on that internals page. Now it works. Will let you know if it comes back.

Other issue: I cannot choose between my logins on my pages where I would need my login credentials?!

[iccub]

@martinlanger90 this is a gap we have to implement, see more at #5250

As a workaround you have to copy and pass your credentials manually from the Saved-Logins screen

[Apraptor]

@bsclifton @soner-yuksel I just wanted to thank you again for finally bring password sync to iOS. It has saved me many times already to be able to look up a password from Timbuktu.

There is one qualify of life feature that doesn't seem to be implemented yet, which is to allow any iOS app to tap into the saved passwords. Currently, I still have to double save my passwords to Keychain so that iOS app can access them without having to manually look it up every time. Do you know if this is a feature that can be enabled also?

Thanks again.

[soner-yuksel]

@Apraptor thanks for kind words.

About your question, we have plans to register Brave Application as a Password Manager. We will mention here when we start working on it.

[soner-yuksel]

Btw the Password Manager (Auto-Fill Provider) work will be landing with brave/brave-browser#36028

You can check the status from that issue.