1230391 - Disable password visibility toggling in the capture doorhanger outside Nightly

Status: VERIFIED FIXED

(Toolkit :: Password Manager, defect)

Description

[Matthew N. [:MattN]]

+++ This bug was initially created as a clone of Bug #1203294 +++

There are still more follow-ups on this UI so disable this UI with the pref behind an ifdef for Nightly through Beta.

Comment 1

[Matthew N. [:MattN]]

Attachment: MozReview Request: Bug 1230391 - Disable password visibility toggling in the capture doorhanger outside Nightly. rs=bnicholson

Bug 1230391 - Disable password visibility toggling in the capture doorhanger outside Nightly. rs=bnicholson

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/fx-team/rev/aea828e2cdf7

Comment 3

[Matthew N. [:MattN]]

Comment on attachment 8695621 [details]
MozReview Request: Bug 1230391 - Disable password visibility toggling in the capture doorhanger outside Nightly. rs=bnicholson

Approval Request Comment
[Feature/regressing bug #]: Bug 1169702
[User impact if declined]: Users will experience an unpolished password capture visibility toggle. They may be surprised that their password is revealed.
[Describe test coverage new/current, TreeHerder]: Reverting to existing behaviour for non-Nightly which has been tested for years.
[Risks and why]: Low risk reverting to previous behaviour.
[String/UUID change made/needed]: None

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/aea828e2cdf7

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8695621 [details]
MozReview Request: Bug 1230391 - Disable password visibility toggling in the capture doorhanger outside Nightly. rs=bnicholson

Too late for 43 as this missed the beta 9 build.

Comment 6

[Liz Henry (:lizzard) (relman/hg->git project)]

Sorry, wontfixing for 43 but we should take this for 44.

Comment 7

[Matthew N. [:MattN]]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #6)
> Sorry, wontfixing for 43 but we should take this for 44.

If we don't take this for 43 then the damage may already be done so I don't think we would disable on 44 and instead would wait for the follow-ups. Note that we disabled this on betas for the last two versions without any trouble in bug 1203294 and I really don't think we should ship the feature in the current state due to bug 1217134, bug 1174900 and the related bug to not allow toggling after the initial close of the doorhanger. All three of these bugs are about the ability to reveal a user's passwords in plain text when they don't expect it.

Can you reconsider?

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

Yes, ok.  Sorry I missed your needinfo. We will be doing a dot release for 43.  I can take it for that, or in case we do an rc2.  I'll approve this for uplift to beta and release now.

Comment 9

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8695621 [details]
MozReview Request: Bug 1230391 - Disable password visibility toggling in the capture doorhanger outside Nightly. rs=bnicholson

After discussion with MattN it sounds like we need to take this for aurora, beta, and m-r; low risk and better for user privacy

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/bf585498f2a0
https://hg.mozilla.org/releases/mozilla-beta/rev/366dd2904726
https://hg.mozilla.org/releases/mozilla-release/rev/5b66df4523cf

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-b2g44_v2_5/rev/bf585498f2a0

Comment 12

[Liz Henry (:lizzard) (relman/hg->git project)]

Can you verify this is fixed on 43.0 or 43.0.1? Thanks.

Comment 13

[Liz Henry (:lizzard) (relman/hg->git project)]

Matt, are you seeing that this is fixed on release?

Comment 14

[Matthew N. [:MattN]]

Yes, fixed on release.

Comment 15

[Andrei Vaida [:avaida]]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #12)
> Can you verify this is fixed on 43.0 or 43.0.1? Thanks.

We'll take care of this first thing tomorrow.

Comment 16

[Bogdan Maris, Desktop QA]

Verified that the password visibility toggling in the capture doorhanger is not available anymore on Firefox 43.0.2, Firefox 44 beta 2 and latest Developer Edition 45.0a2 across platforms (Windows 7 64-bit, Mac OS X 10.11.1 and Ubuntu 14.04 32-bit).