101637 - Expire master password after each time it is used

Status: RESOLVED FIXED

(SeaMonkey :: Passwords & Permissions, defect)

Description

[Stephen P. Morse]

Add ability to be prompted for your master password once per session (current 
implementation), or each time you hit a page where you've saved a password for 
additional security.

[For the record, I think this is a bad idea.  But it is something that marketing 
wants in the PRD for mach V.]

Comment 1

[Stephen P. Morse]

Attachment: patch to expire master password after each use

Comment 2

[Stephen P. Morse]

cc'ing pchen and alecf for reviews

Comment 3

[Alec Flett]

cool. I like the other code in there too. sr=alecf

Comment 4

[german]

Can sombody add a screenshot so I can see what the enhanced user experience
looks like. I do not have access to a development environment. Thanks!

Comment 5

[Stephen P. Morse]

Attachment: screen shot requested by german

Comment 6

[Paul Chen]

r=pchen

Comment 7

[Alec Flett]

sr=alecf

Comment 8

[Todd Pringle]

A couple thoughts after looking at the Preference Panel:

'Encrypting versus Obscuring' will not be understood by the majority of our
users.  Maybe something like 'Security Options' or 'Protecting Sensitive
Information' would be a better header.

After the sentence that begins "A password is used..." I would suggest that we
add something like "By default, you are only asked for this master password 
once per browsing session.  For additional security, you can choose to be
prompted for your master password each time you visit a site with a saved password."

Then the checkbox currently titled "Expire master password after each use" would
be better phrased "Ask me for my master password each time I visit a site where
Netscape has saved my password."

Or something like that.  German?  Adding docs for input as well.  Steve, please
hold off on checking this in until we reach some consensus on the UI.  Thanks.

Comment 9

[Stephen P. Morse]

Todd, too late -- I checked this in before seeing your comment.

However the issues you are now raising are separate from this bug report.  
Please don't morph this report but rather open a separate report on the new 
issues.  They all apply to wording changes (all but one of which predate this 
new work) and can easily be changed by modifying a single .dtd file once the new 
wording is agreed upon.

Comment 10

[Stephen P. Morse]

And if you want to re-evaluate the wording on the password-pref panel, please 
look at the use of "Web Passwords" as the header.  Somebody added that 
relatively recently and I wasn't even aware of it.  This should simply be 
passwords to be consistent with all the other items in the tab panel.  Please 
add that to the new bug that you will be opening.

Comment 11

[Stephen P. Morse]

Actually, now that I look at it, I believe that I put the new pref in the wrong 
place.  Rather than appearing on the so-called "web passwords" pref panel, it 
should go on the "master passwords" pref panel.

I just looked at that panel and was surprised at I saw.  Namely:

   Mozilla will ask you for your master password
   o The first time it is needed
   o Every time it is needed
   o If it has not been used for ____ minutes or more

So what does "Every time it is needed" mean?  Sounds like it should be doing 
exactly what we want.  But I just tried it and it didn't do anything.  I tried 
to check the code but it appears as though this code is PSM and the source is 
not in our build tree.

cc'ing some of Bob Lord's people to see if they can tell us if this pref is 
supposed to do the very feature that this bug report was requesting.

Comment 12

[Terry Hayes]

See bug 87334.  This is probably duplication of the normal "ask every time"
feature of PSM.

Comment 13

[Stephen P. Morse]

But is that feature working?  I tried it out and nothing happened.

Comment 14

[Stephen P. Morse]

We still need to integrate this pref in the web-password pref panel with the 
equivalent pref in the master-password pref panel.

But in the meantime I noticed that I put the code that tests for the expiration 
in the wrong place.  As a result, you will get prompted several times per form 
for your master password instead of only once.  The fix is just a matter of 
moving some code inside an if statement.

Reopening and attaching a patch to fix the original patch.

Comment 15

[Stephen P. Morse]

Attachment: patch to fix original patch

Comment 16

[Stephen P. Morse]

cc'ing alecf and law for reviews

Comment 17

[Alec Flett]

Comment on attachment 52664 [details] [diff] [review]
patch to fix original patch

sr=alecf

Comment 18

[Bill Law]

Comment on attachment 52664 [details] [diff] [review]
patch to fix original patch

r=law

Comment 19

[Stephen P. Morse]

fix checked in.