27994 - "Remember password" broken

Status: VERIFIED FIXED

(MailNews Core :: Networking, defect, P3)

Description

[Ben Bucksch (:BenB)]

Since some time (at least a week), Mailnews always prompts me for my IMAP
password, although remember_password is true and the correct password (in plain
text :-( ) is set in prefs.js.

The checkbox setting in the Account Manager does not stick.

This is a big bummer for Mailnews testing/debugging.

Guessing component. Bug #27475 is somewhat related, but I don't think, it's the
same bug.

Comment 1

[Ben Bucksch (:BenB)]

Beta1 nomination.

Comment 2

[Richard Zach]

Do you have single signon turned on (Edit | Preferences | Advanced > "Prefill
usernames and passswords")?

It looks to me like what's happening is that the remember_password pref is
ignored if single signon is off.  Probably there is a plan for better
integration with single signon.

If you do have it on, do you also check the box "Remember password" when you get
prompted?

CC morse

Comment 3

[Scott MacGregor]

Unfortunately, I don't believe there is a bug here. A while ago, we stopped
looking for your password in prefs and instead extract it from the single signon
database.

Now, if you have remember password checked, we store your password in the single
signon db. However, when you first start up mail, in order to get your password
we have to open the sigle signon db which requires us to ask you for your s.s.
password.

I feel your pain but you and I are in a minority as far as the correct behavior
for remember_password. It no longer means what it did in 4.x.

jefft/morse how do you want to resolve this bug?

Comment 4

[Richard Zach]

But: If you have the advanced preference "Prefill usernames and passwords"
turned off, MailNews will still ask you for a password, even though you have
remember_password=true.  This is very confusing.  The wording of the pref
"Prefill usernames and passwords" strongly suggests that it only applies to web
pages that ask for usernames and passwords, and not that it also applies to mail
servers (where nothing is "prefilled" anyway, and you are never asked for a user
ID).

Ideally what should happen, I think, is this: If remember_password is true, you
look for the password in the signon db, regardless of whether "Prefill usernames
and passwords" is on.  If it is on, the checkbox in the password dialog should
reflect remember_password: if you already set the account pref, you shouldn't
have to click "remeber password" again.  And if remember_password is false,
clicking "Remember password" in the signon dialog should turn it on.

Comment 5

[Ben Bucksch (:BenB)]

All of the following were shown as on in the UI:
- "Save password" in the Account Manager
- "Automatically prefill usernamesd and passwords" in Prefs

"Save this value" (password?) in the password dialog didn't stick.
Yesterday or the day before, the password dialog changed its appearance and
"Save this value" doesn't even change its state on click.

Although "Automatically prefill usernames and passwords" in Prefs was shown to
be on, clicked twice on it to make sure, it is on. (I also clicked several times
on "Save this value" (password?) in the password dialog.) Now, the password is
stored.

Apart from the above mentioned bugs, I agree with Zach, that "Save password" in
the Account manager and "Save this value" in the password dialog should be
linked or one of them thrown out. I also agree, that "Save password/this value"
should actually save the password, regardless of an (seemingly unrelated) other
pref.

However, I'm happy, that my password is stored now, thanks.

Comment 6

[Richard Zach]

Bug 28100 for the checkmark on "Remember this value" not being sticky.

Comment 7

[lchiang]

cc: jglick for UI

Comment 8

[jglick]

Just a note:  The dialog should actually say "Save my password" instead of "Save 
this value".

Comment 9

[Stephen P. Morse]

There's also a box that pops up for you to enter just a username and another 
that pops up for you to enter both a username and password.  So for consistency 
the three boxes would have to say:

   Save this password
   Save this username
   Save this username and password

I thought that the last one was too long and sort of redundant (since the box 
had a field labelled username and another labelled password).  That's why I 
chose the wording

   Save this value (for the first two cases)
   Save these values (for the third case)

Comment 10

[daver]

Steve M. why is this required for beta1?

Comment 11

[Stephen P. Morse]

I have no idea -- I'm not the one who nominated it..

Comment 12

[Ben Bucksch (:BenB)]

I nominated it, because I think, "Save password" is basic for usability.

If I couldn't figure out, how to enable it (because of all kind of wierdness and
bugs), I don't think, the average "beta-tester" will.

Comment 13

[leger]

Putting on the PDT- radar for beta 1.  yes, a big problem, but no time to fix 
for beta1.  will fix for beta2.

Comment 14

[Richard Zach]

Suggest this be release-noted: "Mail and news will not remember passwords if the
Password Manager is disabled."  Should the Pref UI also mention this in the
Password Manager panel (i.e., add sentence to description "P.M. also enables
mail and news to remember passwords for your mail servers.")?

Comment 15

[Ben Bucksch (:BenB)]

Please note, that "Automatically prefill usernamesd and passwords" *was* shown
as enabled in the UI for me; I had to dis- and enable it to make it work.

Comment 16

[Scott MacGregor]

Moving my remaining M14 bugs to M15 which is the next targeted milestone.

Comment 17

[lchiang]

bulk move to M16. Not an M15 stopper.  If you disagree, pls comment in bug and 
cc: [e-mail]

Comment 18

[selmer (gone)]

Doesn't seem like a beta2 stopper.

Comment 19

[selmer (gone)]

Cleanup work, marking M18.

Comment 20

[Scott MacGregor]

I believe we cleaned up all of these issues. 

Comment 21

[esther]

verified, since the writing of this bug, checking the box for saving password
now saves the password (no-securely) and prompts with a message about chosing a
more secure saving of password.  So the behavior is like 4.7 unless the user
takes the initative to use Password Manager making it more secure.  All of this
is working using pr3.