1410753 - Clearing application data allows downloading of an decrypted password database copy

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: Firefox Accounts, defect, P2)

Description

[hakurou46]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
Build ID: 20170926190823

Steps to reproduce:

[Verified on a Samsung Galaxy S7 Edge (SM-G935F)]

Under the System Settings > Application Manager, select Firefox.
Choose the option to Clear Data.
Wait for your Firefox Sync to finish syncing.
Try to login to a website for which you have saved account data.


Actual results:

The mobile device fills in my username and password without asking for my Master Password.
The Master Password has been removed and a new one needs to be set.


Expected results:

There are several options for what should have happened; the simplest would be requiring a new login to any Firefox Account on the device if the browser has recently been re-initiated.

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

Moved this to Sync. This would involve invalidating the Sync credentials if the app data has been wiped.

Comment 2

[Nick Alexander :nalexander [he/him] (PTO August 1-10)]

This is as expected.  Clear Data doesn't clear Android Account settings; that's a key feature of the Android Account feature.

It's possible that clearing data _should_ require re-login to your Firefox Account, but I really don't think that's how other Android apps work.  hakurou46, do you need to sign in again to say Dropbox/Facebook/gmail after you Clear Data?  That definitely was not the case some years ago, but perhaps the expectation has changed.

grisha: abovens: do you have opinions?

Comment 3

[Nick Alexander :nalexander [he/him] (PTO August 1-10)]

I don't think this is sec- anything, but I didn't mean to remove the flag.

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

In the security rating guide sec-moderate lists "Local storage of passwords in unencrypted form" which this is. It is a way around master password a security feature in Firefox. The bug allows an attacker to clear the master password. The attacker then can access the user's accounts and passwords via about:logins or visiting the site with a stored password. I agree that the the user is in a bad state already since the attacker has unlocked access to the user's device.

Comment 5

[Nick Alexander :nalexander [he/him] (PTO August 1-10)]

(In reply to Kevin Brosnan [:kbrosnan] from comment #4)
> In the security rating guide sec-moderate lists "Local storage of passwords
> in unencrypted form" which this is. It is a way around master password a
> security feature in Firefox. The bug allows an attacker to clear the master
> password. The attacker then can access the user's accounts and passwords via
> about:logins or visiting the site with a stored password. I agree that the
> the user is in a bad state already since the attacker has unlocked access to
> the user's device.

OK, that's pretty clear.

Comment 6

[:Grisha Kruglov]

We're certainly violating the "least surprise" principle for the intersection of Master Password, Firefox Account, and clearing of app data. This is another failure of our current implementation of Master Password.

We're probably doing the wrong thing just for the intersection of Firefox Account and clearing of data. As Nick alludes, that's more of a question of how other applications behave on the platform. Given that most Android applications are quite unlikely to use the Accounts APIs, most applications will require a re-login after their data has been cleared.

There are two approaches here:
- we can tackle the narrow case of MP
- or we can tackle the broad case of clearing data in presence of a Firefox Account.

If we're going to continue supporting MP, I think we must at least do the work for the narrow case. It's probably worth tackling the broader change as well, but that requires a bit more thought. E.g. I'm sure we have users relying on this behavior. Do we just bite the bullet and break some user patterns for the sake of behaving similarly to other applications on the platform? I think we should. The "accounts" system is pretty well hidden in the Android settings, and I bet most people aren't aware they can delete a Firefox Account from outside of the browser itself.

Comment 7

[:Grisha Kruglov]

Some prior art: Bug 1368562, Bug 1259701.

Comment 8

[Andreas Bovens [:abovens]]

Why doesn't clear data clear all passwords? 

Also, I noticed that unlike other applications, the "Firefox" account in Android's Account settings doesn't seem to have a "Remove this account" option, unlike other accounts listed there. Is that something we can/should control?

I'd like someone in the Security team to look into what's happening here. Who would that be?

Comment 9

[:Grisha Kruglov]

"Clear data" does clear out passwords IIRC - the "problem" is that it doesn't clear out Firefox Accounts information, thus allowing Sync to re-download passwords. This by itself isn't too bad (and generally "works as intended"), but combined with use of Master Password it does create a surprising situation.

Indeed, we don't have "Remove account" in that menu. NI myself to see why not. On my device, WhatsApp doesn't have that option either, but Office and Google accounts do list it.

Comment 10

[hakurou46]

To my knowledge, Android adds the "Remove Account" button? If it doesn't show under Accounts -> Firefox -> (Menu Key, ⋮, or similar options menu), you likely have to tap the e-mail address for the Firefox Account in question, and from within that menu it should be removable. It most certainly is on my device.
WhatsApp is the same - you first have to tap the app you want to sign out off, then tap once more on the account you want to sign out from (If you're signed into several accounts under the same heading, e.g. Google, this is a lot more self-explanatory)

Comment 11

[James Willcox (:snorp) ([e-mail]) (he/him)]

I'm setting this as a P2 to get it off the triage list. If that seems wrong to anyone (Wesly?), please feel free to change it.

Comment 12

[:Grisha Kruglov]

Regardless of the "Remove Account" behaviour, we're going to change how "Clear data" affects syncing. New behaviour, once Bug 1429735 lands, is to require user to re-login on a device once they've cleared application data. This will, in turn, will help resolve some of our Sync+MP-related issues.

Comment 13

[Andreas Bovens [:abovens]]

That sounds reasonable.

Comment 15

[:Grisha Kruglov]

This has been resolved in Bug 1429735.