1120684 - Recipes that allow login credentials to be used across multiple domains (i.e., realms)

Status: NEW

(Toolkit :: Password Manager, enhancement, P3)

Description

[Chris Karlof [:ckarlof]]

Some web sites span multiple origins, and the same login credentials can be used to authenticate oneself at all of the origins. I call this the "authentication realm" problem. It comes up in multiple contexts, including:

* the realm allows login on http and https pages
* the realm allows login from multiple subdomains
* the realm allows login from completely different domains

Currently, the password manager will store duplicate entries for each of the origins, which is not ideal, particularly if the credentials ever change.

This is bug is to support recipes to indicate that a set of origins should be treated as "the same" by the password manager for indexing, capturing, and filling purposes.

Comment 1

[Jesse Ruderman]

Two things worry me:
* An evil recipe could steal your passwords from a target site. Are these recipes written/reviewed/released as part of Firefox?
* A recipe that equates origins with different security properties makes users less secure. Especially http vs https.

Comment 2

[Selek Respa]

(In reply to Jesse Ruderman from comment #1)
> Two things worry me:
> * An evil recipe could steal your passwords from a target site. Are these
> recipes written/reviewed/released as part of Firefox?
> * A recipe that equates origins with different security properties makes
> users less secure. Especially http vs https.

I would assume that the user is responsible for umtimately grouping domains together.
The Browser should do nothing but maybe give suggestions that need approval.

We already use the credentials for the non-encrypted version of a website on the encrypted counterpart.
Password changes are not synced back so new password won't be aautomatically submitted on the insecure part.

Comment 6

[Matthew N. [:MattN]]

Safari has this concept already and stores their recipes in the DomainsWithAssociatedCredentials key of WBSAutoFillQuirks.plist that ships with Safari.

This list will also be very useful for duplicate checking (bug 1118553) as a login probably shouldn't be considered a duplicate if the same credential is currently saved on two domains for the same "realm".

Comment 7

[mlissner]

As a first step, is it crazy to grab the duplicate list from LastPass? It has a built in list that we could probably use, if the lawyers give it the OK.

It'd be nice for FF to have this list built in at the outset.

Comment 8

[Matthew N. [:MattN]]

Getting a list of these sites from some external source is something we will consider.

For our future reference https://support.logmeininc.com/lastpass/help/duplicate-stored-passwords-across-multiple-sites-lp040007 talks about the default global list the LastPass has.

Comment 10

[Bianca Danforth [:bdanforth]]

Mentioning this here from a related bug (Bug 1639737):

...it seems reasonable that if/when we implement realm support, we could provide a way for users to add their own realms if they would like to associate a login with multiple domains...

Comment 11

[THE_N4R4NT]

Attachment: Masjessa

Approval Request Comment
[Feature/Bug causing the regression]:
[User impact if declined]:
[Is this code covered by automated tests?]:
[Has the fix been verified in Nightly?]:
[Needs manual test from QE? If yes, steps to reproduce]:
[List of other uplifts needed for the feature/fix]:
[Is the change risky?]:
[Why is the change risky/not risky?]:
[String changes made/needed]:

Approval Request Comment
[Feature/Bug causing the regression]:
[User impact if declined]:
[Is this code covered by automated tests?]:
[Has the fix been verified in Nightly?]:
[Needs manual test from QE? If yes, steps to reproduce]:
[List of other uplifts needed for the feature/fix]:
[Is the change risky?]:
[Why is the change risky/not risky?]:
[String changes made/needed]:

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration:
User impact if declined:
Fix Landed on Version:
Risk to taking this patch (and alternatives if risky):

See https://wiki.mozilla.org/Release_Management/ESR_Landing_Process for more info.

[Security approval request comment]
How easily could an exploit be constructed based on the patch?

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?

Which older supported branches are affected by this flaw?

If not all supported branches, which bug introduced the flaw?

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?

How likely is this patch to cause regressions; how much testing does it need?

Comment 12

[Matthew N. [:MattN]]

Apple has open-sourced their realm list under an MIT license! https://github.com/apple/password-manager-resources/blob/master/quirks/websites-with-shared-credential-backends.json

Comment 13

[Tim Giles [:tgiles]]

Attachment: Bug 1120684 - Allow autocomplete to use related realm credentials. r=sfoster!,leplatrem!,dimi

Comment 17

[[e-mail]]

Same thing for:
https://en.wikipedia.org/
https://en.m.wikipedia.org/
https://de.wikipedia.org/
https://de.m.wikipedia.org/

https://eu.battle.net/login/en-us/
https://us.battle.net/login/en-us/

Comment 18

[[e-mail]]

Same thing for:
https://www.banggood.com/
https://de-m.banggood.com/

Comment 19

[Tim Giles [:tgiles]]

Attachment: Bug 1120684 - Add websites-with-shared-credential-backends dump to tree. r=leplatrem

Comment 20

[Phabricator Automation]

Comment on attachment 9199383 [details]
Bug 1120684 - Add websites-with-shared-credential-backends dump to tree. r=leplatrem

Revision D103105 was moved to bug 1687996. Setting attachment 9199383 [details] to obsolete.

Comment 21

[Phabricator Automation]

Comment on attachment 9177498 [details]
Bug 1120684 - Allow autocomplete to use related realm credentials. r=sfoster!,leplatrem!,dimi

Revision D91205 was moved to bug 1699705. Setting attachment 9177498 [details] to obsolete.

Comment 23

[Emanuele]

Excuse me for the duplicate :(

I read all the bug and one thing maybe is not mentioned: will it be possible for the end user to add domains on his own configuration?