1466512 - Policies: Make Master Password mandatory

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, enhancement, P3)

Description

[narutards]

At the moment I have the "Offer to save logins" policy set to disabled, which in turn means that I cannot save logins and passwords.

This policy was put in place because our security guy does not want the passwords to be stored in (virtually) plain text, so without a master password. The same settings are in place for IE and Google Chrome.

He did tell me that I could allow users to save their passwords in Firefox _IF_ I could make it so that the master password is mandatory.

Sadly there is no such option at this point in time. Would it be possible for you to add such a policy that would enable the master password option, make it mandatory (so users cannot disable it) and require the user to set a master password on first start (after the policy has been applied)?

That would be greatly appreciated.

Comment 1

[:Felipe Gomes (needinfo for replies!)]

In theory we could, but the first run experience would be bad.. And first run is already a critical moment with other things being shown to the user..

A different approach would be to add an option to Firefox that makes the option "Ask to save logins and passwords" only respected if there's a master password in place. This would probably be simpler to implement and lead to a nicer experience. And we would create a policy just to enforce this setting.

Comment 2

[Mike Kaply [:mkaply]]

I agree the user experience won't be great, but we've had multiple requests for this and I think we can use what we have.

Comment 3

[Mike Kaply [:mkaply]]

Attachment: Bug 1466512 - Add a policy for forcing a master password. r?MattN

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Rather than first start, could it be part of the first (and any subsequent until the password is set) attempt to save credentials?
Something less wordy than this, but like this: "Your organization requires a master password be set to encrypt credentials before they can be saved: (Set one now and save / Not now / Don't ask to save in the future)"

Comment 5

[Mike Kaply [:mkaply]]

I'll see how straightforward that would be. The problem is there are quite a few places where passwords can be saved.

Master password will probably be going away completely soon with the new Lockbox stuff so I'm not sure how much I want to invest in it.

Comment 6

[Mike Kaply [:mkaply]]

Attachment: Bug 1466512 - Update about:logins to support MasterPassword policy. r?jaws

Comment 7

[Mike Kaply [:mkaply]]

Attachment: Bug 1466512 - Update LoginManagerPrompter to support MasterPassword policy. r?MattN

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/44c03736a07a
Add a policy for forcing a master password. r=fluent-reviewers,MattN,flod
https://hg.mozilla.org/integration/autoland/rev/dfc7af8d8ed6
Update about:logins to support MasterPassword policy. r=jaws
https://hg.mozilla.org/integration/autoland/rev/a55f2483d39e
Update LoginManagerPrompter to support MasterPassword policy. r=MattN

Comment 9

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/44c03736a07a
https://hg.mozilla.org/mozilla-central/rev/dfc7af8d8ed6
https://hg.mozilla.org/mozilla-central/rev/a55f2483d39e

Comment 10

[Mike Kaply [:mkaply]]

Comment on attachment 9140568 [details]
Bug 1466512 - Add a policy for forcing a master password. r?MattN

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: New policy
• User impact if declined: Unable to use new MasterPassword policy.
• Fix Landed on Version: 79
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Lots of tests, has baked a while.
• String or UUID changes made by this patch: String for policy decription (policy specific l10n is pre approved)

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9140568 [details]
Bug 1466512 - Add a policy for forcing a master password. r?MattN

Approved for 78.1esr.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/34dd40076a4e
https://hg.mozilla.org/releases/mozilla-esr78/rev/1279e63e70e5
https://hg.mozilla.org/releases/mozilla-esr78/rev/741bad1bfb3c