pfp

Updated deprecation note, now explaining that PfP 3.x exists.

This release introduces support for multiple databases. If more than one database is configured in PfP Native Host, you will be able to choose the database when unlocking passwords.

Additional changes

• Added support for password tags.
• Added filtering by site name and tags to All Passwords page.
• Added “Text size” extension option.
• Added “Move password” menu entry, moving password to a different site.
• Added a warning when passwords are filled on unencrypted HTTP sites.
• Added notes icon next to password title when notes are present.
• Double-clicking password title opens password editor.
• Made clearing entered value easier when selecting a site.
• Improved detection of hidden fields when filling in.
• Dropped “unlimited storage” permission, it is no longer necessary.
• Fixed: PfP 2.x passwords for “(none)” are imported under pfp.invalid site.
• Fixed: Access key underline isn’t visible on letters like “g.”
• Fixed: Whitespace becomes hidden if an access key is underlined before it.

This release fundamentally changes the extension’s approach. Rather than working as a stand-alone browser extension, PfP now relied on PfP Native Host application. The latter provides it with access to a single KeePass database file on the user’s hard drive, all data is kept in this file. The database can be modified by another application like KeePassXC in parallel.

Due to the changes, this version is not an update to PfP 2.x but rather a separate browser extension. Data can be migrated by exporting it in PfP 2.x and importing it in PfP 3.x.

Additional changes

• No longer requesting permissions for all websites (using activeTab permission).
• Passwords are no longer being generated on demand. All passwords are kept in the database, safely encrypted.
• Sync functionality has been removed. Instead, you can now use external solutions to sync the database file across multiple devices.
• Export functionality has been removed. You can get a copy of the database file using your file manager of choice.
• Importing CSV files has been improved, accepting more formats than LastPass exports now.
• Import now asks for confirmation, displaying the titles of passwords being imported.
• Password recovery codes are protected with a password which is not necessarily your main password.
• There is no longer a revision field. Instead, a title field has been introduced which can be different from the username field.
• All entered passwords can be made visible by clicking the eye icon next to the field.
• Existing passwords can be edited, not merely replaced.
• “Make generated” and “Bump revision” password menu entries have been replaced by “Duplicate password.”
• By default, a random password is generated when a password is added.
• Added a progress indicator when unlocking passwords.
• All Passwords page now correctly displays line breaks in password notes.
• Migrated to Manifest V3 (Chrome and Opera only, not Firefox yet).
• Fixed: Access key hints should not be printed.

PfP: Pain-free Passwords is no longer being developed, this is going to be the last release. It contains a corresponding notice, informing users about their options.

Other changes:

• Added the option to export data into generic CSV, for import in other password managers.
• Removed support for legacy (PBKDF2) passwords. Migration of data from EasyPasswords 1.x will no longer happen, neither will it be possible to import old backups.
• Fixed: Browsers won’t always display a focus ring around links.

This web-only release makes the web client compatible with websites using localStorage for data unrelated to PfP. Previously, such data might cause PfP to fail.

• Implemented access keys in the user interface, displayed when Alt key is kept down.
• Various improvements to the way autofill works (issues #102, #108, #109, #110, #111).
• Updated and unified icons.
• Switched to another code generation tool, producing more compact and more readable application code.

This release affects the web client only. It fixes a minor security issue: when opening external links from the web client, these pages could replace the web client by a different document.

This release fixes display of sync errors in Firefox on Android (issue #105). In addition, there is a number of minor improvements:

• Esc key will no longer lock passwords, previously this made it impossible to close pop-up via keyboard without locking.
• Improved styling of unexpected errors in pop-up, no overlap with the tab strip any more.
• Made sure a field gets keyboard focus after recovery code is entered.
• Improved display of recovery code errors, particularly wrong format version.
• Made the user interface more accessible for screen readers.
• Improved localization approach, each component now has a separate localization file.

This release drops backwards compatibility with EasyPasswords 1.x. Any legacy passwords will be converted to stored passwords, and unencrypted backups will no longer be imported.

Also, the user interface has been reorganized to make it more intuitive and convenient. There is a tab strip on the left side of the PfP pop-up, allowing to switch between different parts of the functionality. Ctrl+Up and Ctrl+Down shortcut keys are an alternative to using the mouse here.

Other changes

• Default shortcut key is Ctrl+Shift+F now (can be adjusted via browser's configuration interface), it will work both on Firefox and Chrome.
• Improved autofill functionality on pages with user name input only, if the user name field has keyboard focus it will be filled out and submitted (issue #82).
• Made "Fill in" button of the first password focused initially, so that pressing Enter will immediately fill in the password (issue #42).
• Improved sync protocol to make it more resistant against tampering by the storage provider (issue #86).
• Improved initial scaling of the pop-up in Firefox on Android (issue #94).
• Added remoteStorage as sync backend (issue #87).
• Displaying extension options in the pop-up as well now, to make them easier to discover.
• Turned website name into a clickable link (issue #101).
• Added "Copy user name" item to the password menu (issue #101).
• Made it more obvious which icon in the password list the mouse cursor points to.
• Improved keyboard navigation in the password menu (Home/End keys will work as well now), added similar keyboard navigation to sync storage provider selection.
• Added keyboard navigation via arrow key to the password list, both horizontally and vertically.
• Fixed: Import would always convert all generated passwords to stored if triggered when passwords are locked.
• Fixed: Copying password to clipboard results in loss of keyboard focus.

This is an intermediate release on the way to PfP: Pain-free Passwords 2.2. The user interface received a major overhaul but the visible changes are only few at this point. More coming soon!

Changes

• Fixed: Keep password notes when converting legacy passwords, also keep notes by default when password revision is bumped or a stored password is replaced by a generated one (issue #100).
• Removed PfP logo next to master password prompt, not helpful.
• Many parts of the pop-up implemented as overlays now, which makes them more obvious. Also, there is a consistent way of closing them.
• Switching to recovery codes no longer opens a separate page when adding a stored password.
• More consistent and reliable recovery code input.
• Better keyboard navigation in the password menu, UpArrow and DownArrow keys will work.
• More consistent support for the Esc key (not working in Firefox due to https://bugzil.la/1443758), pressing Esc will dismiss current action, on the password list it will lock passwords.
• No more modal prompts on the All Passwords page, user interface consistent with the pop-up here.
• Better and more consistent presentation of unexpected errors, also possible to dismiss now.

This minor release adds "Replace by generated password" password menu option making it easier to replace stored passwords. Also, websites not enabling buttons after password has been filled in by PfP should hopefully not happen any more.

The major change in this release is the new sync functionality via storage providers Dropbox and Google Drive (issue #24, #83, #84). It can be used as an automatic backup, but also to sync changes between multiple devices.

Other changes

• Backups created with a different master password can be imported, generated passwords will be converted into stored passwords then (issue #69).
• Pop-up now allows selecting a different website and will display an autocomplete list to aid site selection (issue #52).
• Better support for passwords not bound to a website, one can select the special (none) site name from the autocomplete list (issue #41).
• Keyboard navigation: pressing Escape won't close the pop-up but trigger the Cancel button instead (doesn't work in Firefox).

For the first time, there is now a public release for Microsoft Edge. A number of work-arounds for Edge bugs has been implemented (some limitations still remain), at least Edge 41 is required. In addition, an incompatibility with older Firefox versions has been resolved (issue #78).

This minor release addresses the following issues:

• Added an easier way to replace Easy Passwords 1.x passwords (issue #73).
• Fixed: Copying user name from the pop-up would sometimes include whitespace (issue #71).
• Fixed: Inconsistent checkbox visuals on the options page.
• Fixed: Documentation links wouldn't open in the web client.
• Fixed: Web client doesn't show any progress indicator while loading (issue #76)
• Website name field no longer shows up empty on special pages, shows a placeholder instead.

This is the first release under the new name "PfP: Pain-free Passwords," previous releases went as "Easy Passwords." This release also introduces significant updates to the cryptography powering the extension:

• All metadata saved by the extension as well as backups are now encrypted (issue #47).
• Password generation now uses scrypt algorithm rather than PBKDF2, making guessing the master password even harder (issue #58).
• AES-GCM algorithm is used for encryption rather than AES-CBC (issue #47).

What this means for users

There will be a six months transitional period:

• Passwords generated with the old algorithm are still supported, you have to check "Easy Passwords 1.x password" when recreating them however. Once the transitional period is over, these passwords will be converted into stored passwords, recreating them will no longer be possible.
• Unencrypted backups can still be imported. You should create new backups however, importing unencrypted backups will not be possible once the transitional period is over.

Side-effects of the cryptography update

• All Passwords page can no longer work without a master password and will ask for it if necessary.
• Password notes will now be displayed directly instead of the message "Notes encrypted and saved," no separate decryption step necessary for notes. Showing them on the All Passwords page is optional (issue #65).
• Importing backups created with a different master passwords will fail completely rather than produce a bogus partial result.

Other changes

• A better online version is now available, having most of the extension's functionality.
• Terminology change: "legacy passwords" are called "stored passwords" now.
• All Passwords page will now contain a recovery code for stored passwords. It is safe to print and allows recovering the password if entered into PfP later, assuming that the same master password is still used (issue #64).
• LastPass export files can now be imported just like PfP's own backups (issue #26).
• Added some explanation text to the All Passwords page (issue #66).
• Stored passwords can have revisions as well now, meaning that different passwords for the same username are possible.
• Import and export icons should be more obvious now (issue #49).
• Worked around a Firefox for Android bug, pop-up wasn't being closed after filling in a password (issue #61).
• Fixed checkbox visuals in Firefox.
• Decryption errors will produce a more helpful error message (issue #68).

Fixed an error showing up in Chrome when password is copied to clipboard.

First public release

Got rid of ugly scroll bars showing up on Windows.

Minor improvements to the way passwords are being filled in.

• Fixed typo
• Code cleanup
• Added Chrome and Opera version