1088697 - Master password prompt for sync should be distinct from the classic prompt

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager, defect)

Description

[fl0]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Build ID: 20141020184313

Steps to reproduce:

I'm using FF 34 beta and it seems each time FF is booted and want to sync I've to type in my master password. This is great and I suppose it means my sync credentials are encrypted in some way :)
However this prompt is completely identical to the classic one and moreover when you go to manage your password you see that your credentials I've not been used (i.e. 'last use' of the FF account credentials doesn't follow the sync request)



Expected results:

So if the classic system is used to retrieve the sync credentials, it should be checked why the date displayed in last use doesn't match the last use for sync.
If another system is used, the pop up should specify it's about sync in order for the user to be able to understand this prompts and keep logic with the last use function of the password manager.

Comment 1

[fl0]

After a little bit of test, it appears that after typing your master password into the sync prompt, the list of credentials stored in the password manager is accessible, meaning that this prompt is well linked to the password manager.
So I think the problem clearly comes from a bug in the way the password manager record the usage of the password in this specific scenario.

Comment 2

[:Gijs (he/him)]

Richard, I have a hunch you might know more about what's up here. Can you nudge this bug in the right direction? Thanks!

Comment 3

[Richard Newman [:rnewman]]

Sync does indeed unlock your MP, and does so to retrieve credentials from pwmgr.

Both Sync 1.1 and 1.5 use Services.logins.findLogins to retrieve credentials. (See services/sync/modules/identity.js, services/fxaccounts/FxAccounts.jsm.)

Sounds like password manager doesn't have only one call path...

Comment 4

[Justin Dolske [:Dolske]]

It's generally agreed among UX/Engineering/Product that we don't want to further develop the existing master password functionality, as it's a poor fit for current needs and our current direction in this area.

Comment 5

[fl0]

Thank you for your answer but is there any official guidelines leading to this policy ?
As this subject, sometimes brought up here and is generally answered like this.

What are current needs according to the UX/Engineering/Product ?

I mean it's clearly good that persona  for example can solve the need for storing password but it's not like it's widely adopted.
You cannot deny that there is a need for high security password manager, as there are companies with this only product ?

Why don't throw some effort into keeping up to date an already existing system and offering every one of your users a high level a security ?

May be this functionality could be replaced by sync (as it seems "in your current direction") encrypting the whole profiles important data on the local storage ? and so offer an even higher level of security to your user?