Clarification about auto type matching with browser extension

[frankitox]

Hello! I'm trying to configure KeePassXC with firefox such that I could use the Auto Type shortcut to fill login forms. The thing is I'm not sure how the matching works, is there any docs that explain this? I also see a lot of options. For example, there's global general options (Settings -> General -> Auto-Type):

• A1 Use entry title to match windows for global Auto-Type
• A2 Use entry URL to match windows for global Auto-Type

There's also in Settings -> Browser Integration -> General

• G1 Match URL scheme
• G2 Return only best-matching credentials

In my use case I have two AWS accounts, when going to the login page the title is something like Amazon Web Services ... and the URL something like https://us-east-2.signin.aws.amazon.com/.... Now, I tried turning off A1 and leaving A2 on, also with G1 and G2 on. But when I press the Auto-Type shortcut the popup lists ALL my entries, is this a bug?

If I turn A1 on then it starts matching titles, but it seems to ignore URLs. Is it possible to only match URLs?

I'm using KeePassXC 2.7.7, Firefox 125.0b3 and the latest version of the extension.

[frankitox]

I just found another thing. If I press Alt+Shift+M the popup lists all entries, but if I press Alt+Shift+O it says there's no TOTP found.

[droidmonkey]

Auto-type has nothing to do with browser extension and browser integration. Auto-type uses window titles to match sequences you define. You can call Auto-type from the browser extension and it'll pass the domain you are currently on as a search parameter.

[frankitox]

Oh, thanks for the clarification. I realized that if I use one of the extension shortcuts such as 'Alt+Shift+I' to trigger password filling, it does use the URL and it works fine. But then this means I simply can't use global Auto-Type to match the current tab URL, right?

[droidmonkey]

You can use both, but global Auto-Type only uses the window title. There was an extension that put the url in the window title but I think it went away.

[michaelk83]

To clarify, if I understand correctly, this means that global Auto-Type without the extension is vulnerable to phishing attacks? Since a phishing website can set any title they want. Is this documented somewhere? I didn't see any such warning in the user guide.

How does the "Use entry URL to match windows for global Auto-Type" setting work?

[phoerious]

Yes, it is.

As @droidmonkey said, there used to be a browser extension that put the URL in the title as well, but that's just for convenience and inherently unsafe. The website itself can put any URL it wants in the title as well and then malicious.example.com would suddenly match myaccount.google.com. If you want to protect yourself against typosquatting or phishing in general, use the browser extension.

[varjolintu]

Just to note: If you trigger Global Auto-Type from the extension side using the context menu, then KeePassXC is doing a URL match instead of window title when searching matching credentials.

[frankitox]

I just tried and that doesn't work. Even if it did, it defeats the purpose of using shortcuts.