1368562 - Clear Data will re-sync without user intervention

Status: RESOLVED DUPLICATE of bug 1429735

(Firefox for Android Graveyard :: Firefox Accounts, defect)

Description

[2761c4f2]

User Agent: Mozilla/5.0 (iPad; CPU OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) FxiOS/7.5b3349 Mobile/14F89 Safari/603.2.4

Steps to reproduce:

I went to app manager and deleted cache/savings (as I forgot my master password). 

FF Android 53.0.2 
Samsung Galaxy SIII Android 4.1.2 (root)


Actual results:

When I reopened Firefox, I could easely set a new Masterpassword and access my saved passwords! 


Expected results:

FF should at least ask to reenter password for syncronising passwords etc. Without that, I can take someones phone, delet cache (@ app manager) and access he's personal log-ins, passwords, history etc.

Comment 1

[Daniel Veditz [:dveditz]]

Did you delete the entire app? I wouldn't expect the sync settings to be in the app's cache, it's saved as a Sync'd account in Android settings. You'd have to delete the sync'd account to stop sync.

Even if this is undesired behavior it doesn't need to be hidden because it's not something that will help someone mount remote attacks, and hiding bugs just makes it harder to find people to work on them.

Comment 2

[Sebastian Kaspari (:sebastian; :pocmo)]

Yeah, that's correct the sync account is stored as an account in the Android system. Clearing the application data won't remove the account. So the next time sync runs it will restore the data locally (but not the master password). Both features have been developed independently - so this might have been an oversight. However it's not easy to define what the expected behavior is here?

Comment 3

[Richard Newman [:rnewman]]

Uninstalling the app will remove the account; the bug title is wrong. "Clear Data" in Android settings will not, but it will clear the "app data".

That's all relatively expected on Android, and we have no ability to see that user interaction and to delete the account at that point.

This has been reported before as an area of confusion, but most of the confusion is simply about the separation of account and app -- just as on iOS users get confused about having Settings in the main iOS Settings app rather than inside the app itself.

I think it's reasonable to store some token in the app data that will be deleted, and require FxA re-auth if it's missing. The observed user behavior would be the requirement to sign in again if they Clear Data.

On the other hand, if we do that we'll get users who see Firefox using a ton of storage, blow away the cache and stored data, and then can't remember their FxA password. They'll come along and ask where all their data has gone -- "but Dropbox doesn't lose my data when I forget my password!". Because Clear Data is an OS feature, we don't have the opportunity to tell the user that they'll need to sign in again.

wrt MP specifically:

1. MP as implemented needs to die. But a Firefox-specific PIN-like feature would _still_ be blown away by deleting app data. After all, that blows away _all_ of our data and prefs.
2. We expect access to the unlocked phone to be sufficient to access data on the phone. MP is a bit of a strange and broken exception to that rule.

Comment 4

[:Grisha Kruglov]

(In reply to Richard Newman [:rnewman] from comment #3)
> I think it's reasonable to store some token in the app data that will be
> deleted, and require FxA re-auth if it's missing. The observed user behavior
> would be the requirement to sign in again if they Clear Data.

We could do that. But as you point out...

> On the other hand, if we do that we'll get users who see Firefox using a ton
> of storage, blow away the cache and stored data, and then can't remember
> their FxA password. They'll come along and ask where all their data has gone
> -- "but Dropbox doesn't lose my data when I forget my password!". Because
> Clear Data is an OS feature, we don't have the opportunity to tell the user
> that they'll need to sign in again.

I wonder if this confusion might be a net negative for most users. 

However, speaking very subjectively it seems to me that most high profile applications on Android don't use the accounts system. There are certainly enough incentives for app developers to _not_ support it. I don't this we would use it if we were developing this today. And it's reasonable to assume that users will expect needing to re-login after clearing app data, at least as much as getting confused by it.

> wrt MP specifically:

We still have MP, with a somewhat reasonable user expectation that it will help in cases such as this one. As far as I know, while "it needs to die as implemented", currently there are no concrete plans to move forward with either removing it or improving it.

Approach suggested above might just be the crutch we need until situation with MP moves forward in some way. This might also get us to behave like most other Android applications out there when it comes to account systems.

Comment 5

[2761c4f2]

sorry for not following up... how ever, it seems like there is still no solution, so my recommendation ==>

USE ANOTHER BROWSER in your smart-phone! otherwise you risk to compromise all your passwords ans log-ins!!!

Comment 6

[:Grisha Kruglov]

Bug 1429735 will move account into "password required" stage after app's data is cleared.