Browser: Chrome extension updates wrong vault entry rather than saving new entry

[jikamens]

I have an account at https://forums.mozilla.org/ in my vault. I create a new account on https://support.mozilla.org/. After I log into that new account at https://support.mozilla.org/en-US/users/auth, the Chrome Bitwarden asked me, "Do you want to update this password in Bitwarden?" and if I say yes then it changes the password in the https://forums.mozilla.org/.

Related issue: I actually have five different "mozilla.org" sites in my vault, but when Bitwarden asks, "Do you want to update this password in Bitwarden?" it doesn't say which of those sites it's going to update.

The "Do you want to update..." prompt should indicate which vault entry it's planning on updating. Furthermore, it should offer the option of saving a new vault entry rather than updating an existing one.

[kspearrin]

I assume you are using the same username/email? This is what it compares to see if it should create a new item vs update an existing. Since all of the items are matching the same base domain, mozilla.org, it doesn't see them as new items, just that you are updating an existing item for mozilla.org with the same username/email. You can change the URI match detection to distinguish that they are two different accounts.

https://help.bitwarden.com/article/uri-match-detection/

"Host" should probably work.

[jikamens]

TL;DR The fact that the add-on is behaving as designed does not mean that the design is correct. Both of the changes I suggested above would make its behavior much more user-friendly and robust.

Yes, username matches.

I see a lot of room for improvement here.

It's not at all clear to me that it makes sense that the match detection logic used when auto-filling should be the same as the match detection logic used when determining whether to save or update a site.

There should be a way to set a default match detection option across the entire vault, with individual vault entries inheriting the default unless they are explicitly changed, rather than the option being pegged to each individual vault entry. I have over 1,000 entries in my vault which I imported; am I to go back and change all of them? There isn't even any way to set this option during an import, and I didn't even know it existed when I did the import.

Regardless of what I wrote in the previous two paragraphs, my original statement that the prompt asking the user whether they want to update the password should tell the user what password they're updating.

Regardless of what I wrote in the previous three paragraphs, I still think the usability would be much improved by adding a "save new site instead" button to the "Do you want to update..." prompt.

[soenkeliebau]

I'd like to add my two cents to this discussion as well. For me the issue was my different Slack account.
The domain I sign into will always be .slack.com and I'll always use the same mail address as my username - but they are still separate accounts with different passwords. I got only the option to "update your password" though.
According to what is written above this is due to the base domain and my username being equal.

Not sure what the proper way forward would be, I assume there is a reason why subdomains are not compared in this check..
But maybe offering the option to "create new account" every time a new password is detected would solve this. Once the password has been added to any account for this domain it wouldn't be new any more and the button would disappear.