TextExpander and Secure Input

How TextExpander Works

TextExpander expands snippets in response to what you type. But when you are typing a password or entering other sensitive information, a feature called Secure Input ensures that TextExpander—along with other applications—can’t see what you’re typing.

Normally, Secure Input is a good thing; you wouldn’t want TextExpander or any other applications to see your passwords. Secure Input is usually turned off as soon as you leave the password field or sensitive information area. But sometimes Secure Input will stay enabled even after you are finished typing sensitive information. In such cases, TextExpander will stop functioning until Secure Input is disabled.

How Secure Input Can Cause a Problem

As you type characters on your keyboard, they pass through parts of OS X and are usually handed to the active application. There, they will appear on the screen as parts of words, or they might be treated as commands, or they’ll be handled some other way. Applications such as TextExpander can register to see characters that you type, and even modify them, before the active application receives them. This observation of your typing is called key logging, and it is how TextExpander knows that you have typed an abbreviation that should be expanded into its snippet.

Any application can prevent key logging by enabling Secure Input. With Secure Input enabled, all typing is passed directly to the active application—no other applications can observe your typing. This way, Secure Input ensures that no malicious key-logging software or “spy-ware” will be able to see your sensitive data. Secure Input is generally enabled when you type into a password field (). Some applications also enable Secure Input at other times, which is appropriate as long as they turn Secure Input off once it is no longer required. Apple has published a technical note which specifies how and when Secure Input should be turned on and off.

How to Fix It

Unfortunately, there are a few situations where Secure Input is left in its “enabled” state when it should not be—when you have finished entering sensitive information, or when you have begun to use a different application than the one that turned on Secure Input. In these cases, you will not be able to use TextExpander until Secure Input is disabled. So how can you disable Secure Input?

TextExpander will let you know when Secure Input is enabled by updating its menu bar item to indicate that expansion is disabled. If the application enabling Secure Input is not the current application, TextExpander adds a “caution” symbol to its menu bar icon and Dock icon. (TextExpander checks Secure Input status about every 15 seconds, so the icon display may lag a bit behind the actual state.) While the menu icon displays as disabled, the “Secure Input enabled by (app name) / Secure Input Prevents Expansion…” menu item indicates which application appears to have enabled Secure Input. Quitting that application will disable Secure Input, allowing TextExpander to function again.

Work-around

In some cases you can avoid Secure Input remaining enabled if you turn off any auto-submit feature of an auto-login that you are using.

Instead, once you fill the password field, or your auto-login fills the password field, click whatever “Login” or “Submit” button is provided along with the password rather than pressing the Return key on your keyboard.

However, depending on the individual application, there may be other ways to avoid this problem. If you’re having trouble with an app enabling “Secure Input” or getting the “Expansion Disabled” message, check to see if the app you’re having trouble with is listed here. If it’s not, please let us know and we will investigate.

Box

The Box Sync application leaves Secure Event Input enabled after you log in. Quitting Box Sync and starting it again solves the problem. (As of January 2014).

Firefox

If you encounter trouble with Firefox, please update to the latest version; older versions of Firefox had a bug which could cause Secure Input to remain enabled incorrectly.

Update: Should be resolved as of November 2012 build.

Fluid

Fluid enables Secure Input and never disables it when a password field is focused while submitting a form. Focusing on another field or removing the focus works around the issue. The Fluid author is aware of the problem and hopes to fix it in a future update.

Google Chrome

Chrome sometimes fails to turn Secure Input back off after typing in a password field, particularly if the cursor is still in a password field when the password is submitted. If you find a specific sequence of events that causes this problem, please let us know, and let the Google Chrome team know so they can reevaluate this behavior. A quit and restart of Chrome will restore TextExpander.

iFinance

iFinance enables Secure Input at launch and never disables it. You might offer feedback to the developer that this is not how to use Secure Input properly.

LastPass

LastPass will currently enable Secure Input on Google Chrome as long as you are logged in to LastPass. There’s a fix for this in the works; upgrading to the latest prebuild of LastPass will resolve the issue, and that solution should be coming to the release version of LastPass soon. In the meantime, this forum post on the topic sheds a bit of light on this issue.

Update: Should be fixed as of August 2012 build.

loginwindow

When TextExpander tells you the name of the application that has enabled secure input, it’s giving you a “best guess” that’s sometimes inaccurate. When TextExpander reports that “loginwindow” has enabled secure input, it’s likely that TextExpander can’t quite tell which application has enabled secure input, so instead it’s showing that application’s “ancestor, ” loginwindow.

This can also happen when OS X itself has left secure input enabled after you’ve logged in, or after you’ve entered your password to wake the computer from sleep or from screensaver. If it is the screen saver, a restart of your Mac will enable TextExpander.

Sometimes your Mac can become confused about the state you are in when logging in using the Touch ID feature. The “loginwindow” error can stay active because the computer does not recognize that you have fully logged in. In these cases, signing out then signing back in using your actual password rather than the Touch ID should correct the issue.

If it is not the loginwindow, try quitting your other running apps. Once the offending app is quit, TextExpander will immediately re-enable. You can use this to determine which app is leaving secure input enabled.

If none of this helps, restarting the computer while ensuring that your apps do not reopen in the same state can correct this issue. To do this, you will select “Restart” from the Apple menu in the upper left-hand corner of your Mac and then uncheck the “Reopen Windows when Logging Back In” option that is showing on the Restart prompt that pops up on your computer.

Notational Velocity

The Notes portion of Notational Velocity’s preferences has an option for “Secure Text Entry.” This enables Secure Input while editing within Notational Velocity. Turn this off to permit the use of TextExpander within Notational Velocity. Newer versions only enable Secure Input while Notational Velocity is active, but older versions left Secure Input on until you Quit.

Terminal

Terminal has a “Secure Keyboard Entry” menu item so you can turn Secure Input on and off within Terminal. You should probably enable this when entering passwords. Turn it off again afterwards to enable TextExpander expansion.

Other terminal applications such as iTerm2 have similar settings.

Webroot SecureAnywhere

Webroot SecureAnywhere turns on secure input and leaves it on by default. To turn it off, choose “Pause Secure Keyboard Entry” from the Webroot SecureAnywhere menu item.