login.launchpad.net tells me “Bad bot, go away! Request aborted.”

Question

I've recently encountered problems trying to log into anything that relies on login.launchpad.net. If I try to sign in to, say, http://review.openstack.org, that takes me to https://login.launchpad.net/some_random_string/+decide. After filling in my credentials and clicking "Log in", I end at up https://login.launchpad.net/some_random_string/+login with the message:

Bad Request

Bad bot, go away! Request aborted.

It appears to be browser plugin related (using Chrome instead of Firefox avoids the problem, as does starting Firefox in safe mode, which disabled all add-ons).

I'm using Firefox 38.0.5. I have uBlock installed, but even with that plugin disabled I still see the same behavior. I am currently going through the process of disabling one plugin at a time, but so far nothing other than safe mode seems to work.

Does anyone know what could be the root cause of this behavior?

Update

It appears to be the LastPass plugin, for reasons that are still mysterious. I'm going to see if I can trace the login request and see what's different with this plugin enabled.

Answer 1

I contacted LastPass support, and they provided the following suggestion:

1. Please remove the site in question from your vault (have your username and password handy)
2. And re-save using Save All Entered Data functions: https://helpdesk.lastpass.com/adding-a-site/#h1
3. try clearing cache by going to Lastpass icon> Tools> Advanced> Refresh sites and then clear local cache, log out then log back in. Test the issue again.

This seems to have resolved my issue, and I am once again able to log in to launchpad etc.

Answer 2

Although this is fixed for LastPass Users, the underlying issue was not solved.

The login form contains an honeypot field named "openid.usernamesecret". It is made invisible by CSS property "display:none". It's the bad boy here: It will also be filled by other password managers (KeeFox in my case), with your old username.

<div style="display: none;">
    <label>Dieses Feld leer lassen, um zu beweisen, dass Sie ein Mensch sind
        <input name="openid.usernamesecret" value="myself@emailhost.com" type="text">
    </label>
</div>

• So delete the entry from KeePass2 / KeePassX / LasstPass or other form helper addon (remember your password though).
• Make sure the field is empty when you reload the page, before you login (check with Firebug or Web Inspector). In case you don't know how to use those tools, just restart Firefox.