Hacker News Reader

Comment by ferdowsi | Hacker News Reader

It's curious that we haven't seen dedicated effort towards a consistent password autofill API in browsers, like what is present in Android. Even the Credential Management API seems to have not picked up traction for passwords, though it was extended for use with FIDO2 security keys.

View on HN

Is there one present in Android? My understanding is password managers on Android and iOS abuse a11y interfaces. (I'm not a mobile dev)

iOS has a dedicated API for password managers - Password Autofill (https://developer.apple.com/documentation/security/password_...). It presents passwords in password managers the same way it would passwords in iCloud Keychain.

You still sometimes need to use the interfaces you mention, but increasingly rarely.

This used to be the case, but somewhere around Android 7 (might've been 8 or 9) added proper support for autofill services.

Bitwarden doesn't seem to do this even in Android 10. The Bitwarden UX on iOS is fantastic though, it behaves excatly as you'd expect from a native solution. Any examples of good password managers on Android that uses the proper support for autofill?

Bitwarden definitely supports this interface, I use it. You can check which provider is enabled in your system settings.

Where might I find it and what's it called? I have had a look and can't find anything. Although it's possible Xiaomi doesn't include it in their version of Android.

System -> Languages & input -> Autofill service

Not sure if MIUI was organised differently.

Wow apparently Bitwarden is already set as the autofill service. So it does seem like the Android implementation is not quite as polished as the iOS. Although I'll definitely have to teet a device from a different vendor to be sure it's not some issue Xiaomi has added in...

I'm using it right now on Android. Works fine.

The latest version of Android does, yes. Though they can still abuse the accessibility API for injecting password into applications that don't support this API.

Reply on news.ycombinator.com