104389 - Easy ability to disable password manager on install

Status: RESOLVED EXPIRED

(SeaMonkey :: Passwords & Permissions, enhancement)

Description

[Jason Chambers]

There needs to be an easy way to disable the use of password manager. Places
like my college don't want password manager on the browser since thousands of
students could be on one workstation in a given time of day on any day of the
year. If an unsuspecting person filled out a form (with a password or even
worse, credit card) with the password manager automatically to save passwords
from that site, then other students could retrieve this information (even the
person who set the password manager)

Is there any means right now to do this?

Comment 1

[Stephen P. Morse]

Site can opt out of using password manager by including autocomplete=off in 
either the <input> tag or the enclosing <form> tag.

Comment 2

[Stephen P. Morse]

> with the password manager automatically [set] to save passwords from
> that site,

That's never possible.  The password manager will *always* prompt before saving 
a login from a site.

Comment 3

[Terri Preston]

Agreed, marking verified

Comment 4

[Jason Chambers]

This is not invalid. 

This is truly an enhansement that should be made. Not all places would want 
passwords to be recorded onto their system. Many companies might not want to 
use mozilla if it means theres a way to store passwords. I feel if theres a 
nice convenient way to disable the use of saving passwords on the system, then 
it would be something worth installing. 

I'm trying to encourage my college to install mozilla on the computers to keep 
the idea of having web standards. But every one of them says that they cannot 
do this because of the password manager. Yes yes, you can put a master password 
on it, but thats not going to stop someone on trying to hack the password. 
Especially on an unsupervised workstation. 

If password manager is disabled upon install, then I would feel that this could 
go along way getting my college to support mozilla. I'm personally getting sick 
and tired of having to work with sluggish IE.

Please give this future thought before not fixing this.

Comment 5

[Jason Chambers]

I would also like to point out that this bug will also help out on kiosk mode ( 
or bug 3341 if you will) because whats the point of saving customers passwords 
when they are probably never going to be coming back anyways?

Theres a lot more implementation to this than you think. At least if you are 
going to resolve this bug, please resolve it for later use.

Comment 6

[Stephen P. Morse]

> Please give this future thought before not fixing this.

I didn't mark this as WONT-FIX but rather as INVALID.  Reason is that we already 
give the websites the ability to opt out of password manager so the capability 
that you are requesting already exists.

Comment 7

[Jason Chambers]

except I'm not talking about WEBSITES
i'm talking about, the browser itself

Comment 8

[Stephen P. Morse]

In that case do:

   edit->prefs->privacy->web-passwords

and uncheck the box for "remember passwords"

Comment 9

[Jason Chambers]

I've been talking to some people in #mozilla, and they are agreeing with me 
that this bug should not be marked as invalid but rather wontfix, and even if 
this is the case that it to be reconsidered as being marked as later

adding [e-mail] to cc per request

Comment 10

[Jason Chambers]

That still suggest a security issue as people can just go in and re-enable the 
configuration, although this wouldn't be so in kiosk mode (or so I hope)

Comment 11

[Rafael Ebron (:rebron)]

I think we can fulfill reporter's request by fixing 93553, and 101338.

93553 changes the wording in preferences to be a little more clear (I had no
idea you could disable password manager, all it has to say is check box []enable
password manager)

101338 is to add the disabling of prefs as an option in the password pop-up
dialog box

Comment 12

[Jason Chambers]

These are possible solutions, but I'm asking for obscurity. Having no way to
enable password manager once it is disabled. Have it hidden from the preferences.

Comment 13

[Jason Chambers]

I think the easy way to fix this is a userpref to hide this access so sys admins
can configure it to their likings then have a userpref that will hide the
security/policy panel. Ideas?

Comment 14

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Reassigning to new module owner.

Comment 15

[Brian Crescimanno]

As per this forum thread:
http://www.mozillazine.org/forums/viewtopic.php?t=9949&start=0&postdays=0&postorder=asc&highlight=

and all other threads it references, there is strong user support for adding a
setting to the core preferences dialog which will allow users to disable the
password manager.  I'm not sure if it belongs in this bug or not but I will file
it here and file a new bug with the request if the devs would prefer.

Comment 16

[Brian Crescimanno]

umm...disregard my comments.  Sorry.  I didn't look closely at the new builds
and see the preference available in the preferences dialog.  Oops.

Comment 17

[Robert Kaiser]

This bug report is registered in the SeaMonkey product, but has been without a comment since the inception of the SeaMonkey project. This means that it was logged against the old Mozilla suite and we cannot determine that it's still valid for the current SeaMonkey suite. Because of this, we are setting it to an UNCONFIRMED state.

If you can confirm that this report still applies to current SeaMonkey 2.x nightly builds, please set it back to the NEW state along with a comment on how you reproduced it on what Build ID, or if it's an enhancement request, why it's still worth implementing and in what way.
If you can confirm that the report doesn't apply to current SeaMonkey 2.x nightly builds, please set it to the appropriate RESOLVED state (WORKSFORME, INVALID, WONTFIX, or similar).
If no action happens within the next few months, we move this bug report to an EXPIRED state.

Query tag for this change: mass-UNCONFIRM-20090614

Comment 18

[Robert Kaiser]

MASS-CHANGE:
This bug report is registered in the SeaMonkey product, but still has no comment since the inception of the SeaMonkey project 5 years ago.

Because of this, we're resolving the bug as EXPIRED.

If you still can reproduce the bug on SeaMonkey 2 or otherwise think it's still valid, please REOPEN it and if it is a platform or toolkit issue, move it to the according component.

Query tag for this change: EXPIRED-20100420