Closed Bug 584014 Opened 14 years ago Closed 4 years ago

multiple master password prompts with multiple accounts registered and prompt is ignored

Categories

(Thunderbird :: Security, defect)

Product:
Thunderbird
Component:
Security
Version:
38 Branch
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED
Milestone:
Thunderbird 63.0

People

(Reporter: spam, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: [workaround:comment 57][waiting on bug 177175]) 

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.2.7) Gecko/20100713 Lightning/1.0b2 Thunderbird/3.1.1

In short: If I start Thunderbird and go fetch a coffee, there are multiple master password prompts stacked upon each other when I return.

more details:
- I store my account passwords in Thunderbird and use a master password.
- The number of stacked password prompts is equal to the number of registered accounts (IMAP in my case). 
- The first master password prompt appears right after the start of Thunderbird .
- If the prompt is ignored, every 5 minutes (quite exactly) another password prompt appears at the exactly same location without closing the previous one.
- This continues until there are exactly as many password prompts as registered email accounts.
- If I enter my password in one of the visible prompts, the others continue to stay visible but no new ones appear.


This is not a big deal, but it is a bit annoying. I always think that I entered a wrong password because the topmost prompt disappears after my input but the one below - which was hidden by the topmost one - comes into focus "re-prompting" my password.

Reproducible: Always

Steps to Reproduce:
1. Have more than one (imap) account
2. Have stored the password for these accounts secured by a master password
3. Start Thunderbird and ignore it for at least five minutes

Actual Results:  
If you now move the password prompt, you will see a second prompt beneath it. The second prompt stays visible even after supplying the correct password to the first prompt.

Expected Results:  
There should only be one active password prompt at any given time.
(In reply to comment #1)
> dupe of bug 560793 ?

I don't think so. As far as I can tell there is no NNTP involved (because I don't have any news accounts set up).

I think the password prompt is already meant to be asynchronous but somehow fails (please note the 5 minute delays).
Does this happen with Lightning disabled? I suspect this is a dupe of a Lightning bug.
Component: Account Manager → Security
QA Contact: account-manager → thunderbird
(In reply to comment #3)
> Does this happen with Lightning disabled? I suspect this is a dupe of a
> Lightning bug.

Yes, it even happens in save mode with all extensions disabled:
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.7) Gecko/20100713 Thunderbird/3.1.1

Can somebody reproduce it or have I a strange setup? Because it behaves the same way at work (Win Vista) and at home (Win 7).

Another interesting thing: The password prompt that appears right after start-up is modal but the delayed ones are not, i.e. I can switch focus between all password prompts but not to the main windows (which directs the focus to the first prompt).

Thanks for looking into it.
Anything in Tools -> Error console ? I'm not having that but I'm having 3 accounts only 1 imap with stored password, another one with non stored password and a pop that I need to manually pop. So my setting is a bit different than yours.
(In reply to comment #5)
> Anything in Tools -> Error console ? I'm not having that but I'm having 3
> accounts only 1 imap with stored password, another one with non stored password
> and a pop that I need to manually pop. So my setting is a bit different than
> yours.

In the error console there is a information that "imap.xxxx.yyy : server does not support RFC 5746, see CVE-2009-3555"

Some of my initial statements might be due to coincidence. I tried to reproduce it with a fresh profile and the number of accounts seems to be irrelevant. With the fresh profile I tried it with multiple accounts from the same domain and from different domains. In all cases I got two prompts. The first one after start-up, the second one after the shortest duration that is set to check for new messages every X minutes.
And the second prompt is for the master password too ?
(In reply to comment #7)
> And the second prompt is for the master password too ?

Yes, it is (if one ignores the first master password prompt completely, i.e., neither press "ok" nor "cancel").
I have the exact same behavior, except that I get the amount of prompts equal to the amount of accounts right at start-up, I don't have to wait 5 minutes to get them.

This "bug" was introduced for me with Thunderbird 3.0 and hasn't been fixed in any subsequent updates. Any version of Thunderbird 2 always asked for my master password only once.

No news accounts either, 3 IMAP and 1 POP account, all saved password in Thunderbird with a master password set. The exact behavior is that I get 3 prompts at start-up, if I fill my password in one of them it get's replaced with another (for the pop account?) so there are still 3 prompts open. If I then fill or cancel the other ones (only have to input my password in any of the prompts once for every account to work), there will pop up any other prompts anymore.

I am reusing the profile that was originally created with Thunderbird 2. My colleague with the mac Thunderbird version (but profile created under version 3) and 2 accounts does not observe the same behavior.
also, for every password prompt I cancel after filling in my password first, I get *3* errors in the error log:

Error: [Exception... "'User canceled Master Password entry' when calling method: [nsILoginManagerStorage::findLogins]"  nsresult: "0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)"  location: "JS frame :: file:///C:/Program%20Files/Mozilla/Thunderbird/components/nsLoginManager.js :: anonymous :: line 522"  data: no]
Source File: file:///C:/Program%20Files/Mozilla/Thunderbird/components/nsLoginManager.js
Line: 522
I believe this is a dup of bug 560793.
I have this problem too. The problem is not related with NNTP (I don't have any nntp account), it's just that TB opens as many prompts as passwords it needs at startup. I have a few mail accounts and lightning calendars and it opens as much as needed. It's like if TB tries to ask for the passwords concurrently instead of just a one and then lock waiting for the master password.

If you have an account that doesn't read mail automatically, when you read it,
you don't have the problem, because when TB needs its password, you have
previously (at startup) entered the master password.

I have the problem with TB 3.1.7 in linux (ubuntu package), but I'm getting
since previous versions.
I have the same problem with Thunderbird 3.1.7 on Ubuntu Lucid Lynx, after upgrading from Thunderbird 2 it now immediately simultaneously brings up one Master Password Request for each IMAP account every time I start Thunderbird.
Same here with Miramar 3.3a3 - I have 3 IMAP accounts set up with passwords stored in the (FIPS-enabled) password manager and I'm getting 3 prompts to enter my master password. I had this exact same problem before with Firefox (s/email accounts/password protected websites/), but with FF4 this was solved. Maybe this rings a bell to someone?

Thanks,
C.
I am not using NNTP but do see multiple password prompts as well. Up to date Fedora Linux system. I have three IMAP accounts configured plus lightening and Google Contacts and I think I see four separate prompt dialog windows every time I start. I have never configured any NNTP settings, AFAIK.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.15) Gecko/20110307 Fedora/3.1.9-0.39.b3pre.fc14 Lightning/1.0b2 Thunderbird/3.1.9 ThunderBrowse/3.3.5
dupe of bug 177175 (yes, that old)?
Christian, Harald, Andrew, does  bug 177175 describe your issue?
Yes, #177175 seems to be the same issue.

However, I'm using Thunderbird 7.0.1 (sigh) now and this "multiple master password prompts" does not happen any more when the Lightning calender extension is disabled. So, feel free to close this with DUPLICATE. I'm curious if the original reporter of #177175 can still reproduce this.
rather than dup, let's make dependent (so it can be found as an open bug in thunderbird)
Status: UNCONFIRMED → NEW
Depends on: 177175
Ever confirmed: true
Whiteboard: [waiting on bug 177175]
Small update from the original poster after several new version. I still get one master password promt when starting Thunderbird (10.0.2) and another one after 5 minutes if I ignore the first one. During testing I had all extensions disabled.

During normal use, I get multiple master password prompts directly when starting Thunderbird anyway, because I also use Lightning and an Exchange Calendar and Tasks Provider. I would have guessed, that this problem can be fixed quickly with a Singelton for the password promt.
For all those annoyed by this bug you may want to check out the extention StartupMaster

https://addons.mozilla.org/en-us/thunderbird/addon/startupmaster/
Try disabling FIPS.

I've had the same problem for years, both on linux and windows. Today, I installed a fresh copy of T-bird 11.0 windows, deleted my profile including files (to be sure there weren't any settings hanging around in SQlite from older versions of T-bird), and created a brand new profile. I added a master password, configured 2 e-mail accounts, unchecked the "check mail at startup" and "check mail every ..." and enabled FIPS. Closed T-bird and started again. When I went to check e-mail, T-bird created 2 master password login prompts.

I went through this process again, except this time, did it in pieces. Everything worked as expected - only 1 master password prompt - until I enabled FIPS. Immediately, T-bird started to prompt twice again. The password dialog says "Please enter the master password for the FIPS 140 Cryptographic, Key and." (It's not obvious why the "and." is there ...)

I disabled FIPS, shut down T-bird and started it again. Next time checking e-mail, only 1 master password prompt."

Repeatable every time for me, even without closing T-bird after changing FIPS.

I have lightning 3.0 installed currently; but the same thing happens without lightning. (I backed up a copy of the profile directory before installing lightning; just now restored that backup, with the same behavior.)
Affects me as well: 2 accounts + lightning => 3 password prompts at startup.
Effects me as well. 3 accounts (2 IMAP, one Exchange) + lightning, 3 prompts.
Anybody from mozilla ever looked into this? The ticket is 2 years old now.
FYI, the Master Password+ addon offers a workaround:

 https://addons.mozilla.org/en-us/thunderbird/addon/master-password/

Though it still seems that it should be fixed in TB core.
Yes, it's been broken a long time. But you might be able to work around it, without an add-on. Do you have FIPS enabled ... ?
Hi! Sorry, been on holiday. 
FIPS seems to be disabled by default for all mail accounts (I see only and enable button) and  I still get 3 authentication windows.
I am getting the multiple master password prompts on startup of Thunderbird as well.

I don't even have multiple e-mail accounts configured in Thunderbird - I only have a single corporate IMAP e-mail account.

I do have Lightning with multiple calendars however - one is the corporate calendar, and the other is my gmail calendar.
Could this be related to (dup? of) bug #177175 ?
I've been living with this annoyance for a long time.  It has me looking for another E-mail client but they all seem less capabel or well organized.  Every time I launch TB I am prompted for my master password twice in pretty close succession.  I seem to have to enter it twice.  I just got a new system and installed Linux Mint 17 (was using 15 until now) and TB 31 (comes with Mint).  I don't know what version of TB I was using previously, but it has been a problem for quite some time (several version at least).

I have 5 imap accounts and two gmail accounts (also imap I believe).  Nothing else for TB on my system.
I get 4 prompts during the start-up of my Thunderbird 31.2.0.

Disabling Exchange EWS Provider 3.2.2 removes 1 prompt (to do with corporate Exchange calendar).

Disabling Provider for Google Calendar 1.0.3 removes further 2 prompts (to do with 2 Google calendars).

I gather the remaining 1 prompt is for the email accounts (I have two, one corporate, one with gmx.com).

Installing the following extension https://addons.mozilla.org/en-US/thunderbird/addon/startupmaster/ delays the start-up of TB until after the master password is entered and provides a working workaround for the problem.
I can reproduce this in the latest beta 38 on Mac OS. bug 643265 seems to be the same issue.
Depends on: 643265
OS: Windows Vista → All
Version: unspecified → 38
Severity: minor → normal
Cudos to comment 31. 

Installing extension https://addons.mozilla.org/en-US/thunderbird/addon/startupmaster/ changed five password prompts with the same password into one.

Great that someone made an extension for this, but really sad that this bug has not been addressed. 
It's been there for 5 years now?
And affected:
Thunderbird 38.3.0
Fedora 22_64
I use Master Password+, which also asks for the master password only once:
  https://addons.mozilla.org/en-US/thunderbird/addon/master-password/

I wish Thunderbird and Firefox could use the system password provider when running on Linux (either Gnome Keyring or KWallet). Chromium already supports them.
XMPP chat account is another source of master password prompt.

I am using two IMAP mail accounts and one XMPP chat account; the mail accounts are configured to check for new mail on startup and the chat account is configured to connect on startup. I get four master password prompts. I enter the password into the first one and confirm it; then I cancel two other prompts. Then, I am prompted for the password to the chat account; this one does not pop up, if I enter the password into the previous master password prompt. I cancel this prompt. The fourth master password prompt is there, waiting to be filled, but unlike the previous ones, it is not focused. I cancel it. Now, I need to check new mail manually and manually connect to chat.

I am using Windows 7, TB 38.4.0. Under old Debian Linux (Lenny), the same version of TB with two POP3 mail accounts, one IMAP account and one feeds account prompts for master password just once. But on Linux, my configuration is overall more complicated – if it would help, I could try to use the same profile under Windows or otherwise play with it, but I doubt it would make any difference here and it will cost me time. If it would help solve this issue, tell me.
(In reply to Tomáš Maleček from comment #36)
> I am using Windows 7, TB 38.4.0. Under old Debian Linux (Lenny), …

Not using the FIPS mode under any of the two instances of TB I use, BTW.
I confirm this bug too, on a *fresh* instal of TB, with 5 accounts.

Also, this issue is not juste annoying: one has to manually hit cancel on the (n-1) over numerous prompt or TB will not sync the accounts (which when going together with "prompt behind window" issues can get really annoying).
I updated Bug #177175 earlier this week when I found a reproducible case with Firefox that did not use any extensions.

Having read this bug, I believe that the fix for Bug #177175 will resolve this issue as well as it appears to be common code to both Thunderbird and Firefox.
As bug 643265 is meant to be fixed by bug 1176399, maybe this one will be fixed, too, once 1176399 lands!?
Maybe this will help some others. My work around, which I think is cleaner and quicker, heads off the multiple password prompt issue before connecting:

Setup:
Always start Thunderbird in Offline mode (Tools > Options > Advanced > Network & Disk Space > Offline. Uncheck Automatically follow detected online state. And Select Manual state when starting up: = Offline)

Then, after starting up, Thunderbird will be in offline mode. Before turning Thunderbird online, press the following keystrokes:

CTRL+i
ALT+o
i
Enter master password
Exit meeting invite without saving

Then, you can go online and the master password prompt will not appear multiple times. This keystroke approach is quick and will become habit after using it several times.

Enjoy!
Hi there,
Am experiencing similar problem. 
TB 52.1.1. Release update channel. Three add-ons: Lightning, Provider for Google Calendar, Dictionnaire français "classique".
TB is configured for four addresses. I get four Master password prompts each time I launch TB.
This started happening a couple of months ago (probably after an update but I couldn't sware to that!) A bit of a bind. I use hibernation extensively, which minimizes the problem since I often only have to relaunch TB after an update.
(In reply to John Thompson from comment #43)
> Hi there,
> Am experiencing similar problem. 
> TB 52.1.1. Release update channel. Three add-ons: Lightning, Provider for
> Google Calendar, Dictionnaire français "classique".
> TB is configured for four addresses. I get four Master password prompts each
> time I launch TB.
> This started happening a couple of months ago (probably after an update but
> I couldn't sware to that!) A bit of a bind. I use hibernation extensively,
> which minimizes the problem since I often only have to relaunch TB after an
> update.

check when 52.2.0 comes out. Or try the beta channel
HOly **** ! They fixed it. I installed the 54.0b2 (32-Bit) version of Thunderbird and no more multiple Passwords Promps ! I am so happy right now. My deepest gratitude to the programmer who took the time to fix this problem!!
A problem that existed for 10 YEARS ++

All my email accounts work with IMAP. I use the extentions Enigmail and Lightning.
Thanks Wayne. I'm on 52.2.1 and no improvement. But 54.0b2 has made Polar happy! I'll look forward to when it comes through on release.

Reading 653678 makes the fundamental problem clearer to me: having popped up our dialogue to get the pwd, we seem to forget that it's already up, and pop it up again as many times as we need to connect to servers, for as long as the user hasn't typed in the correct pwd, either
  - as often as new mail check requires a connection, or
  - when checking each server mail box at startup, so if we have 4 accounts then we get 4 pop-ups.

Doubtless one could test the combination of both causes, say configure 2 accounts to check new mail every 1 minute, should get 2 new popups every minute as long as the correct pwd hasn't been entered.

Anyway looking forward to 54!
Congratulations on Update 55.0b2 - The bug made it back. You made a zombie. wtf
Sorry that was pretty ironic, but I just wonder how these mistakes happen. I'm back to version 54.0b2 and disabled all updates.
(In reply to Polar from comment #49)
> ... I just wonder how these mistakes happen.
> I'm back to version 54.0b2 and disabled all updates.

No mistake. The patch which fixed this had to be backed out because it caused problems with gmail, per bug 1176399 comment 63

It is not known when this will be fixed.
Hi all,
Just updated to 52.4.0 (release channel). Just to say observe slight change and improvement. On launching, I get a total of 5 prompts (I have 4 pop accounts configured). The last one to show (thus covering the others) does not have the focus, I had to click on it to type the pwd. On the other hand the pwd is accepted and the main TB window comes to the top, so the impression is that pb solved! In fact, 4 other prompt dialogues are in the background, I only saw they were there when switching apps.
Bear in mind I'm running Win10 and last week got the big update, but yet another is now pending. So the above observations with Microsoft Windows [version 10.0.15063]
(In reply to Wayne Mery (:wsmwk) from comment #50)
> No mistake. The patch which fixed this had to be backed out because it
> caused problems with gmail, per bug 1176399 comment 63
> 
> It is not known when this will be fixed.

8 years later than initally reported...really?

Considering that it is still present on TB 58.0b2 (32-bit) and 59.0a1 (2017-12-23)(64-bit) on W10 x64 (b16299) and that it remains unassigned makes one wondering whether it will ever be resolved.

2 prompts for imap accounts, one of which is gmail with OA2 authentication, o365 (imap-mail.outlook.com) with normal password authentication and a 3rd imap with normal password authentication.
Does anyone know whether this bug is being targeted before the ESR?
I am seeing the same or similar behavior with Thunderbird 52.6.0 (32-bit) for Windows, operating on both WIndows 7 (Ultimate) and Windows 10 (Home).  I do not have to wait to see the multiple Master Password dialogs pop up; they are presented IMMEDIATELY upon starting Thunderbird.

DETAILS:

I have the following add-ons installed:
  * Lightning, 5.4.6
  * Provider for Google Calendar, 3.3
  * gContactSync, 2.0.13
  * SmartTemplate4, 1.4

I have 2 IMAP accounts and 1 POP account.
One one of the IMAP accounts (Google Mail / Google Calendar), there are 9 sub-calendars.

[A] When ALL add-ons are DISABLED, I get 3 Master Password dialogs.  (Presumably one for each IMAP or POP account.)

[B] When both Lightning and "Provider" are ENABLED, I get 12 Master Password dialogs.  12!
    One might surmise there's one for each account, plus one for each calendar.

[C] Enabling gContactSync or SmartTemplate4 do not seem to have any effect on the count.  I have tried all 18 combinations of enabled/disabled add ons.

[D] Enabling or disabling "check for new messages at startup" has no effect.


PLEASE fix this bug, this is a major annoyance! 

Please also include whatever comments in the code that might help this not to be a reversion in the future.  It seems like the Thunderbird team has fixed similar bugs SEVERAL times over the years, only to have the behavior revert in a later build!
(In reply to Forbin from comment #55)
> I am seeing the same or similar behavior with Thunderbird 52.6.0 (32-bit)
> for Windows, operating on both WIndows 7 (Ultimate) and Windows 10 (Home). 
> I do not have to wait to see the multiple Master Password dialogs pop up;
> they are presented IMMEDIATELY upon starting Thunderbird.

I don't know if this has ever been resolved in the release channel. There have been moments of hope I think but pulled out before release.
The weird thing about this bug for me, is the way it suddenly affects a user who had been unaffected before, presumably your case, certainly mine (see above).
At present the dialogues all appear at launch of TB. My workaround is to simply type the pwd in the topmost dialogue, click OK and then cancel all the others as they appear behind. This seems to be sufficient to allow TB to connect to all the required services.
Whiteboard: [waiting on bug 177175] → [workaround:comment 57][waiting on bug 177175]
Wayne, interestingly I still see 3 prompts after installing "Master Password+". First one pops up and immediately hides, making room for the second, where I enter my MP. Then a third one appears.

In comparison my usual flow atm is:
1) First one pops up and immediately hides, making room for the second, where I enter my MP
2) `esc` the third
3) fourth one pops up and immediately hides, getting one 'normal' password alert for a chat login => `esc` #5
4) `esc` the sixth
5) open chat and hit `connect` manually (I guess this is in relation to the 'normal' password alert)

So it is at least a bit quicker with "Master Password+" and also the chat is connected.
Every now and then I dare to put my thunderbird in auto update mode. But I was not rewarded. I get multiple password promts.


Let's see .. 7 IMAP accounts and 3 password promts. The ratio of asked passwords per account has gotten better.
I am using Version 60.0beta. Let me know what other information I can provide to help fix this problem.
(In reply to Ryan Sipes from comment #53)
> Does anyone know whether this bug is being targeted before the ESR?

There are two issues here, and the short answer is no, neither issue is getting attention much less targeted for version 60. The long answer is some users' issues could be resolved soonish

1. This original bug now depends on bug 1271851 - Decouple Master Password from PSM - which per it's first comment is a complex problem that isn't going to make progress until it rises to the top of the Mozilla priority list.  There is nothing we can do to afffect that.

2. The newer issue (that is not this bug) is what likely impacts most affected users. It is regression Bug 1176399 - Multiple requests for master password when GMail OAuth2 is enabled - which appeared in 2015 in version 38.  This is within our power to fix, and a fix was attempted last year and had to be backed out. If we can assemble and refocus enough developer powers, then we can fix this early in the version 60 cycle. (There is also related Bug 682474 - Lightning hides Thunderbird master password prompt + multiple password prompts - which is also waiting on bug 1176399 to be fixed. And fixing these will also fix our #1 ranked class of crashes - bug 1257058.)

NOTE - The workarounds in comment 57 are good for version 52. But if bug 1176399 isn't fixed in version 60 then we need to help keep https://addons.mozilla.org/en-US/thunderbird/addon/master-password/ working. That means a) helping the author resolve https://github.com/vanowm/MasterPasswordPlus/issues/135 which I filed in December, and b) helping the author adapt to add-on changes that are happening now in version 60.

NOTE - The above issues are all very well understood and no further user reports are required to help resolve them.  Until this is resolved in code, users are encouraged to use the workaround comment 57.
See Also: → 1176399
I can honestly say, I can not read any computer code. As a rational beeing, why should I trust a third party program with my passwords ? 

Wayne Mery, I like to thank you very much for summing up the status and if it doesn't stress you too much, can you please explain how the addons handle the passwords ? How long are they held in working memory ?

My fear is that if the add-on will put my password into a clipbord and keep it in memory then anything can happen..
I put great effort into making strong passwords and changing them regularly. All the effort could be in vain when I use masterpassword add-on. (Weakest Link in the Chain)

Happy Easter Everyone on the mailing list ;)
(In reply to Wayne Mery (:wsmwk) from comment #60)
> That means a) helping the author resolve
> https://github.com/vanowm/MasterPasswordPlus/issues/135 which I filed in
> December, and b) helping the author adapt to add-on changes ...
It's not clear what the issues are and we (mostly) don't have the capacity to debug individual add-ons.
Another work-around which does not require an add-on is to have TB NOT check for messages at startup. This is a completely acceptable solution for me. I have the mail account servers set to check for mail every 5 minutes, so at most I'm only 5 minutes from getting any new mail. Because there is no check on startup, I only get one master password prompt when starting TB. I normally only restart TB after a reboot, so it's really not a big deal for me. Of course others have other needs for which this solution is unacceptable.
Hi Tim, i read your comment. This gives me an idea. Wouldn't it be enough to delay the loading of the accounts by 5 seconds each ? Maybe then the Master Pass Promt (MPP) will appear only once !?

Hm, why is there a queue at all ?

Let me speculate without having seen the code. When an account is loaded it requests a password. When password is encrypted another instance will give the promt, ok. Going a step back, the accounts are loaded without delay and everyone of them is able to call this instance. But I wonder why .. For example in windows, there are programs that I can not open again when they are already running. So, I think what is missing, is a control instance that checks if the instance MPP has already been called. So why don't you add another instance against this race condition ? Or simply delay the loading by 5 seconds.

Loading accounts 1 >> 2 >> 3 >> 4
.. asking for pass
.. encrypted ..
.. asking to open cryptosafe ..
Control instance .. ok open ..
MPP opens
.. asking to open cryptosafe ..
Control instance .. is already open .. do nothing
.. asking to open cryptosafe ..
Control instance .. is already open .. do nothing
.. asking to open cryptosafe ..
Control instance .. is already open .. do nothing
.. asking to open cryptosafe ..
Control instance .. is already open .. do nothing
Let 1,2,3 and 4 be the accounts that are asking for pass. When the module which is trying to decrypt the safe takes too long to load or is busy with other stuff, then the other accounts have a chance to ask for opening the cryptosafe ##. Let '>>' represent the units time that pass while the module is busy and not responding. In that time it can not stop itself from loading. Which makes it all the more clear, that we need another instance of control ** here. 
Another solution I think that could work is to reduce the time for loading the library. Maybe preload it into memory or let the promt window appear first without loading anything and then process. Then the module becomes more responsive and can block additional requests for beeing called.
This control instance could run on another processor.. better then a single thread that is not responsive.. should be no problem since almost all modern computer run with 2 or more processors.

Without control instance:

1) >> ########
2)  >> ########
3)   >> ########
4)    >> ########

With control instance*:

1) >> ** ########
2)  >> ** # 
3)   >> ** #
4)    >> ** #

Same problem (4 prompts) with Thunderbird 60.6.1. MasterPassword+ seems to solve the problem. I'll test several days to be sure.

Same problem with Thunderbird 68.1.2. Unfortunately Master Password+ is not compatible so we can't have this as a workaround now.
Not sure how this has been swept aside for 9 years.

Same problem for my for Thunderbird 68.2.2.

Can masterPassword+ made suitable for Thunderbird 68 so that this will solve the problem?

Any other workaround now that Master Password+ is dead?

Could the Mozilla team finally take care of this problem?

(In reply to Stephaen from comment #69)

Any other workaround now that Master Password+ is dead?

Could the Mozilla team finally take care of this problem?

Just saw your comment above. Was somewhat surprised I'm still subscribed to the bug feed.

The Mozilla team has -- repeatedly -- flatly denied this is a problem and refused to deal with it.
"The user is wrong; we're right, now get over it."

I did. I no longer use Thunderbird, and was personally responsible for a certain organization withdrawing their support from the project because of this pervasive attitude. Do yourself a favor and find some replacement software built by a team that cares what their users think.

Alright, to add insult to injury, I'll close the bug to add some more denial :-( <-- That's actually irony, if you hadn't noticed, see below.

The facts are: The master password problem was actually fixed in bug 1176399 and for Calendar in bug 682474. Those were fixed in shipped at some stage in TB 60 and should definitely be fixed in TB 68. I personally ran a profile for a while with a master password and close to 10 IMAP accounts. I never saw a multiple MP prompt.

That said, there might be some issues still left which occur under certain circumstances. I had a long conversation about that in bug 1523120, from about bug 1523120 comment #26. That was related to a chat password. But in the end, no action was taken and the original reporter declared the bug fixed.

I'll declare this FIXED by bug 1176399.

Now, the project actually does care about its users, but we can't fix what we can't reproduce. There's also not much point of discussing this at comment #71 of a bug report. So PLEASE: If you have a reproducible case of multiple master passwords that you can reproduce on a fresh profile, please file a new bug with the absolute exact steps to reproduce. It's no good saying that it happens on a profile from 1999 that came from Netscape and was migrated various times over the last 20 years.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → Thunderbird 63.0

As one of the people previously affected by this, I can confirm that I stopped getting multiple password prompts quite some time ago.

I find this incredibly easy to reproduce.

  1. Add multiple IMAP accounts.
  2. Have them all "check for new messages on start up"
  3. Have them all "check for messages every 5 minutes" (The time doesn't really matter. I don't think this setting really matters, but I always have it on.)
  4. Optional: Edit some of the IMAP folders to enable "When getting new messages for this account, always check this folder".

The age of the profile doesn't seem to have any relevance.

So far to date the best workaround I've come across is switching off "check for new messages on start up" on all accounts.

Well, as I said in comment #71: I personally ran a profile for a while with a master password and close to 10 IMAP accounts. I never saw a multiple MP prompt.

Yes, and by default that was set to checking at startup and checking every five minutes or so.

(In reply to Adam Reece from comment #73)

I find this incredibly easy to reproduce.

  1. Add multiple IMAP accounts.
  2. Have them all "check for new messages on start up"
  3. Have them all "check for messages every 5 minutes" (The time doesn't really matter. I don't think this setting really matters, but I always have it on.)
  4. Optional: Edit some of the IMAP folders to enable "When getting new messages for this account, always check this folder".

The age of the profile doesn't seem to have any relevance.

So far to date the best workaround I've come across is switching off "check for new messages on start up" on all accounts.

Although it doesn't seem like it should matter, could this be an IMAP v POP3 issue?

I had this problem with my POP3 addresses (I have no IMAP addresses). My work-around was to not check for new messages from any of these accounts, and check every 5 minutes after that. That stopped the multiple master password word prompts. Later, when this bug was claimed to be fixed, I reverted to to check for new messages on startup, and, as claimed, the problem had been fixed for me.

OK, I checked this again. 9 IMAP accounts, all checking at startup, then every three minutes. I enter the MP once at startup, the end. I see no more prompts. As I said: Please set up maybe two of your IMAP accounts on a new profile.

(In reply to Jorg K (GMT+1) (PTO to 5th Jan 2020, sporadically reading bugmail) from comment #74)

Well, as I said in comment #71: I personally ran a profile for a while with a master password and close to 10 IMAP accounts. I never saw a multiple MP prompt.

Yes, and by default that was set to checking at startup and checking every five minutes or so.

Jorg, my post collided with yours, so I did not see your post about this working for you with close to 10 IMAP accounts. So, clearly not a IMAP v POP3 issue.

(In reply to Jorg K (GMT+1) (PTO to 5th Jan 2020, sporadically reading bugmail) from comment #71)

we can't fix what we can't reproduce.
Fair enough.

If you have a reproducible case of multiple master passwords that you can reproduce on a fresh profile, please file a new bug with the absolute exact steps to reproduce. It's no good saying that it happens on a profile from 1999 that came from Netscape and was migrated various times over the last 20 years.

Hey Jorg, is there an easy way to see how old a profile is? I think mine is max. ~3 years old, but not 100% certain.

Setup

TB 68.3.1 on macOS 10.14;

4 IMAP accounts

1 Chat account
3 Calendars

Current MPW prompts

  1. Password prompt #1 comes up and disappears
  2. #2 appears and sticks => entering pw and enter
  3. #3 (#1?) appears => hit esc
  4. #4 appears and disappears (likely for the chat in #5)
  5. #5 says it’s for Gmail (chat) => hit esc
  6. #6 (#4?) appears => hit esc
  7. open chat tab > click "Show chat status" and hit connect (no pw entry needed)

Test Case

If I uncheck "sign-on at startup" for the chat only steps 1 - 3 are required / show up.
Note: Contrary to Adam Reece's work-around above unchecking all "check for new messages on start up" had no additional effect, neither had switching off all calendars.

I am annoyed by this bug, too. I still see this bug, too. Jörg, I cannot confirm your claim that it's fixed. The trouble is that the fix isn't easy.

I just reproduced it in the following way:

  • latest TB 68.x
  • setup email account
  • add XMPP chat account
  • set master password
  • restart

I get three prompts for the MP

Assignee: nobody → kaie
Status: RESOLVED → REOPENED
Resolution: FIXED → ---

Well, OK, that's bug 1199607. Please go and fix it over there.

Status: REOPENED → RESOLVED
Closed: 4 years ago → 4 years ago
Resolution: --- → FIXED

This bug has never been fixed and is going worse. Here is my use case to reproduce it:

  • My Mac (macOS 10.13 High Sierra) starts at 12:00 in the office and starts last Thunderbird for Mac
  • I come in the office between 13:30 and 14:00
  • There are between 10/15 Master Password prompts waiting for me

Notes:

  • I just use 5 IMAP accounts and 3 local calendars, no XMPP chat account, or anything else
  • Settings are "I sign-on and check all new messages at start-up and every minute"
  • For about 1 or 2 years, I had only 2 MP prompts, now much more
  • The only workaround is to force quit TB and restart it to only enter 1 or 2 MP

I was getting multiple password prompts and decided to create a new profile ( as I wasn't sure how old my prior one was ) and readded my mail accounts. With the new profile so far I am only getting a single MP prompt. So it does seem worthwhile reproducing from a brand new profile.

Thanks, Nick. Yes, "seasoned" profiles can contain detritus that can cause a lot of weird and "wonderful" stuff.

(In reply to Jorg K (GMT+1) (PTO to 5th Jan 2020, sporadically reading bugmail) from comment #83)

Thanks, Nick. Yes, "seasoned" profiles can contain detritus that can cause a lot of weird and "wonderful" stuff.

Is there any way of determining profile creation date out of curiosity?

Thanks!.

Not that I know. I have a pretty old one. The sad thing is that TB doesn't offer a "profile refresh" like Firefox. It would be easy to clean out the detritus from a profile without having to create a new one. That clean-out would reset all the preferences but maintain the account setup, stored mail and address books (and maybe other stuff I can't think of right now, this needs a proper design, of course).

(In reply to Jorg K (GMT+1) (PTO to 5th Jan 2020, sporadically reading bugmail) from comment #85)

Not that I know. I have a pretty old one. The sad thing is that TB doesn't offer a "profile refresh" like Firefox. It would be easy to clean out the detritus from a profile without having to create a new one. That clean-out would reset all the preferences but maintain the account setup, stored mail and address books (and maybe other stuff I can't think of right now, this needs a proper design, of course).

While very rough, some of the older files in my profile date from 2011 (!) This could well explain the detritus :-)

Having just gone through the transfer - I agree it would be pretty useful to have something like that. As I use IMAP allowing mail to redownload seemed the easiest method. You would also need to include filters and potentially addons.

I can confirm that multiple MP dialogs still do appear in TB 68. I have three different IMAP account. All are set to check for new messages at some interval. The profile is not brand new, but it's only a couple of years old and has not been migrated at any time.

What happens is that on TB start, there's a single MP dialog, which is a huge improvement compared with TB 60. But if left like that for a while, TB will keep opening new MP dialogs on top of the first one, presumably on every check for new messages.

Aha, finally a case I can reproduce. Yes, with multiple IMAP accounts that all check at startup and then after some time interval, not answering the first prompt leads to a second prompt when TB goes to check again. I only see one second prompt, not multiples. Filed as bug 1606711. Looking at bug 177175 comment #368, that states that the toolkit code should be fixed to avoid a situation like this.

Assignee: kaie → nobody

(In reply to Jorg K (GMT+1) (PTO to 19th Jan 2020, sporadically reading bugmail) from comment #85)

Not that I know. I have a pretty old one. The sad thing is that TB doesn't offer a "profile refresh" like Firefox. It would be easy to clean out the detritus from a profile without having to create a new one. That clean-out would reset all the preferences but maintain the account setup, stored mail and address books (and maybe other stuff I can't think of right now, this needs a proper design, of course).

Thank you Jorg & team for your patience on this thing. For me the multiple MP prompts problem was solved quite some time back, but I use exclusively POP for my 4 e-mail accounts, but also Lightning, with some means or other of synchronising Google Calendar. No chat.

I'm just posting to add a +1 for a profile clean-up tool. It seems to me that this is made even more necessary since the hard-line approach to TB / profile version compatibility which was introduced some time about 68.0. Gone are the days when you could wait out the solving of a bug in a new release by going back.
As you say, such a tool would need a lot of thought and proper design, but I think it would be worth it. <dream>Maybe it could provide a means of returning to a previous version of TB.</dream>

That dream won't come true since for some upgrades we irreversibly convert old internal data structures to new ones. We have a module that does this, see: https://searchfox.org/comm-central/rev/173cf2d391ef0874ab5bc9957f862de196c2f945/mail/base/modules/MailMigrator.jsm#116
You don't need to be a programmer to get the point. Also, between TB 68 and 72 we've migrated address books from the legacy Mork storage to Sqlite. There are also migrations happening in the underlying Mozilla platform databases, for example for security/passwords/certificates, history, etc.

Thanks for the info. I guessed as much.
All the more reason to get on to a profile clean-up tool!

Filed bug 1608031 for "refresh profile".

I can confirm that an old profile might cause the repetitive asking for a password. Mine was quite old (years at least, but so far no problems using the 32 bit TB, but changing to 64 bit and still using this old profile started the problem).
Just created a completely new profile in TB, added all my 13 imap accounts again and TB just asks for the manager password once.

See Also: → 1606711

Problem/Issue: Well, my problem is similar and, as stated by John (comment #89), it appears somewhere after the release of version 68. Today I run 68.5.0-64 bit (from release channel). I can confirm that it require one MP for each of my configured IMAP accounts (no request for the POP ones), reproducing the same behavior reported by Adam Reece (comment #73): at session start, I don't have to wait for the MP prompts, but they are required only once per session.
Environment: As add-ons I have Lightning (for Google calendar sync) and Google Calendar Provider (you guess it). If it matters (and I doubt it) it's a Brazilian "version".
Solution: ?

I've got the same problem in Thunderbird 78... The master password is required multiple times when starting up Thunderbird.. The old versions were able to run an add-on that fixed the problem (Master Password+), but as the add-on system has been changed there seems to be no working fix for this bug at the moment.

This was fixed for me for a long time and then it started appearing again, perhaps starting with version 78.

Updated to 78 today. It's now giving me two Master Password prompts. one before it opens and the other before login.

After I create a new profile and configured several imap accounts, all works fine everytime thunderbird is restarted: Thunderbird ask for Master Password only one time.
After install addon gContactSync Master Paswords ask for passwords two times even when gContactSync is not configured. If remove addon Thunderbird ask for password only one time when it is launched.

Thunderbird 68.10.0 (64-bit) on Kubununtu Linux 20.04 LTS

(In reply to Nigel from comment #97)

Updated to 78 today. It's now giving me two Master Password prompts. one before it opens and the other before login.

Are you using a Mac? Two prompts are expected on a Mac. (unresolved bug)

(In reply to Wayne Mery (:wsmwk) from comment #99)

(In reply to Nigel from comment #97)

Updated to 78 today. It's now giving me two Master Password prompts. one before it opens and the other before login.

Are you using a Mac? Two prompts are expected on a Mac. (unresolved bug)

Nope. Windows 10 pro.

You need to log in before you can comment on or make changes to this bug.