1492387 - Mozilla saves and shows Gmail account password in plain text

Status: RESOLVED DUPLICATE of bug 1477798

(Firefox for Android Graveyard :: Logins, Passwords and Form Fill, defect)

Description

[Qazi Mudassar Ilyas]

Attachment: FireFoxBug.jpg

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:62.0) Gecko/20100101 Firefox/62.0
Build ID: 20180830143136
Firefox for Android

Steps to reproduce:

I logged in to my Gmail account using "Show Password" option enabled. After logging off, when i tried to login again, and double clicked the password text box with "Show Password" option enabled, i was shocked to see my password in plain text presented by Firefox. 


Actual results:

Gmail recently introduced the option of "Show Password" in login screen which shows password in plain text. Once the password is entered with this option ON and login is performed successfully, Firefox seems to have saved this password in plain text. While attempting to loin again, and double clicking the password textbox, Firefox displays the saved password in plain text. 


Expected results:

Firefox should not show the password in plain text. In fact it should not have even saved it in plain text in first place.

Comment 1

[Matthias Versen [:Matti]]

This is wfm on desktop (Windows 10)

Comment 2

[miralobontiu]

Hi,

I was able to reproduce the issue.

Tested with:
Browser / Version: Firefox Mobile Nightly 64.0a1 (2018-09-18)
Operating System: Google Pixel (Android 9)

Thank you!

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

Worth looping in the webcompat team as this may be an issue with the site.

Comment 5

[Adam Stevenson [:adamopenweb]]

Thanks Kevin! Tag miketaylr (I'm out of office).

Comment 6

[Mike Taylor [:miketaylr]]

Is this a mobile issue? Or it happened on Desktop?

Comment 7

[miralobontiu]

Hi Mike,

This is a mobile issue.

Thanks!

Comment 9

[Mike Taylor [:miketaylr]]

Clicking the see password eye icon toggles the input element between type=text and type=password. And yes, when you go back the 2nd time and the input is a type=text, clicking inside will display your password as an autocomplete suggestion.

<input type="text" class="whsOnd zHQkBf" jsname="YPqjbf" autocomplete="current-password" spellcheck="false"
       tabindex="0" aria-label="Enter your password" name="password" autocapitalize="off" autocorrect="off"
       dir="ltr" data-initial-dir="ltr" data-initial-value="">

I'm not very familiar with expected behavior for autocomplete="current-password"... Matt, is this working as intended?

Comment 10

[Matthew N. [:MattN]]

This is a dupe of bug 1477798. The API from bug 1330228 will also help in this specific case.