Sync: can't access account with new e-mail address
Categories
(Cloud Services :: Server: Firefox Accounts, defect)
Tracking
(Not tracked)
People
(Reporter: guy, Unassigned)
Details
User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Steps to reproduce:
Obtain new e-mail service and personal domain from new provider, after E-mail facilities terminated without warning.
Couldn't Sync Firefox as e-mail address no longer exists.
Tidied up Saved Logins, intending to delete just those no longer relevant and, where possible, systematically change e-mail addresses where relevant.
Highlighted a block of entries and (stupidly) clicked Delete All.
Actual results:
Firefox did as commanded: Deleted every Saved Login, ignoring the high-lighted block. My fault, but it's very (too) easily done.
Can't access Sync because Mozilla sending login links to old (non-existent) e-mail address.
Expected results:
When the user loses their original e-mail address (a common enough situation), it should be possible to re-Sync. There is a security issue, but it's fairly easily resolved.
It would help users if Firefox, just for once, ask users "Do you really want to delete ALL Saved Logins?"
|
||
Updated•7 years ago
|
|
||
Comment 1•7 years ago
|
||
Thanks for the feedback!
It would help users if Firefox, just for once, ask users "Do you really want to delete ALL Saved Logins?"
Adding some password-manager folks to this bug to raise visibility of this feedback.
Couldn't Sync Firefox as e-mail address no longer exists.
When the user loses their original e-mail address (a common enough situation), it should be possible to re-Sync.
I'm not sure I fully understand what happened here. Were you already connected to Firefox Sync and it got disconnected when you lost access to your email address, or where you trying to connect to Sync for the first time on that profile?
There is a security issue, but it's fairly easily resolved.
The subject of lost emails is something we've thought a lot about, particularly from a security perspective. I'd be interested in your feedback on what would have been an acceptably secure process for you to follow here, if you're willing to share it.
What happened:
- I have used Thunderbird and Firefox for around 20 years. Sync was an easy way to keep Firefox on my tower and notebook/laptop synchronised, backed-up and easily transferred from one computer to it's successor. The tower was retired at the same time as me, so Sync should have been quietly keeping track of any new Saved logins - I usually make a paper record, but if the paper notebook isn't to hand at the time.... Only using one computer, Sync wasn't obvious.
- A few weeks ago, my e-mail services were terminated.
- Then I accidentally deleted all my Saved logins - a few of which I have no other a record.
- When I tried to Sync-back my laptop, I couldn't login even though I did find a record of the correct password (time-expired?). That's when the loss of the original e-mail account became a problem.
Security:
The risk is of someone unauthorised hacking the Sync account, which of course should never include sensitive logins. The present arrangement of sending a link to the registered e-mail account works well - until that account is deleted!
A solution that occurs to me is to use the e-mail (containing the Change Password link) first 'bouncing' from the registered e-mail address to cause a flag to be set on the Sync account that enables access to an Advanced facility (that's otherwise not visible) to change the registered e-mail address.
|
|
||
Comment 3•7 years ago
|
||
I'm moving this to the FxA component since IIUC it's a feature-request for FxA to allow account recovery after losing access to the primary email address. The current behavior is a deliberate design choice so I'm afraid this feels likely to be a WONTFIX, but ni? Shane for further triage.
It would help users if Firefox, just for once, ask users "Do you really want to delete ALL Saved Logins?"
Do you feel strongly enough about this being a useful behaviour, that we should file a separate bug to discuss and track it?
|
||
Comment 4•7 years ago
•
|
||
(In reply to Ryan Kelly [:rfkelly] from comment #3)
It would help users if Firefox, just for once, ask users "Do you really want to delete ALL Saved Logins?"
Do you feel strongly enough about this being a useful behaviour, that we should file a separate bug to discuss and track it?
We already have this prompt which says "Are you sure you wish to remove all passwords?" https://searchfox.org/mozilla-central/rev/4587d146681b16ff9878a6fdcba53b04f76abe1d/toolkit/components/passwordmgr/content/passwordManager.js#398-407
Screenshot: https://cl.ly/8733a6eae913
|
||
Comment 5•5 years ago
|
||
Thank you for filing this issue. This is not currently on our roadmap, and in an effort to focus our work, we are closing old issues that we are unlikely to be closed in the future. Thanks again.
Description
•