409328 - Auto-saving generates asynchronous prompt for master password

Status: RESOLVED DUPLICATE of bug 287294

(Thunderbird :: General, defect)

Description

[tlauck]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Build Identifier: version 2.0.0.9 (20071031)

While in the middle of composition the user is asked to enter the Master Password for the Software Security Device if a draft is saved automatically by Auto-Save.

Reproducible: Always

Steps to Reproduce:
1.Configure with personal S/MIME key in software security device.
2.Enable master password, default signing of messages, and auto saving.
3.Start Thunderbird, begin composing a message.
4.Wait for auto-save to happen.
Actual Results:  
User is spontaneously prompted to enter the Master Password.

Expected Results:  
The password prompt should have occurred after the user issued the Send command.

Thunderbird saved a signed draft. This is inappropriate at best -- at worst it would tend to impact the validity of signed messages or even to place a user in legal jeopardy. Thunderbird should save unsigned drafts.

Users should never be asked to enter passwords except in response to an explicit request they are making. To do otherwise is to condition them to respond to phishing attacks.