1551723 - Ability to ask for a different generated password from autocomplete

Status: ASSIGNED

(Toolkit :: Password Manager, enhancement, P3)

Description

[Matthew N. [:MattN]]

If a user doesn't like the password that was generated, they should have an option to generate a new one of the same format.

Comment 8

[Frederik Braun [:freddy]]

This bug has gathered lots and lots of duplicates. I think we might want to bump the priority.

Comment 9

[Sam Foster [:sfoster] (he/him)]

Forwarding to Serg who expressed an interest in this one.

Comment 10

[Sergey Galich [:serg]]

Attachment: WIP: Bug 1551723 - Ability to ask for a different generated password from autocomplete r?tgiles,sfoster

Comment 13

[firefox005]

What happens, when firefox for all user the same password generates???
I think this is a critical bug

Comment 16

[jan klopper]

(In reply to firefox005 from comment #13)

What happens, when firefox for all user the same password generates???
I think this is a critical bug

Exactly

In the context of an admin creating or settings passwords for various users, those passwords will al be generated to be exactly the same. Closing the browser, or any other action by this admin user will not trigger new generation of passwords.
This means an admin might be handing out the same password to many users.

Comment 28

[Jeremy Nickurak]

Adding a use case here -- if firefox continues auto-generating the same password by design for the site, and the site has declared the password vulnerable (either due to a leak or because it's been used before, is too old, anything similar), there is currently no way to generate a new secure password.

Comment 29

[Alexander Balagurov]

Issue still exists in current version

Comment 32

[Johannes]

Created another bug to discuss further enhancements: https://bugzilla.mozilla.org/show_bug.cgi?id=1915598

Comment 33

[Phil Stracchino]

To add a specific use case here: On two successive days I have gone to transunion.com to register an account, and on each day Firefox's password manager has offered me a 4 CHARACTER "secure" password. Erasing the password and trying again, reloading the page, restarting Firefox and trying again, seem to result in the same password for the same site on the same day, and so far at least (admittedly on a sample size of 2 passwords) Firefox seems to consistently generate a 4-character password for transunion.com.

This seems ... let's say troublingly deterministic, particularly in light of the absence of any option to force generation of a new password.

Comment 34

[Daniel Veditz [:dveditz]]

showing the same password in the same session is bug 1767002 -- it's an attempt to keep people from getting locked out if they didn't save a password and need it again in a subsequent step of creating the account or logging in for the first time.

The transunion.com issue should possibly get its own bug. When creating an account step one has a box for the last 4-digits of your social security number. This input is type=password and maxlength=4. I didn't fill in that information so I didn't get to the next steps, but I assume we've created the password based on that field, and that now that same one is what we suggest in a later "real" password field.

The ability to ask for a new one (this bug) would solve that, but also maybe if maxlength is some ridiculously short value we should not offer to generate a "secure" password.

Comment 35

[Phil Stracchino]

(In reply to Daniel Veditz [:dveditz] from comment #34)

The transunion.com issue should possibly get its own bug. When creating an account step one has a box for the last 4-digits of your social security number. This input is type=password and maxlength=4. I didn't fill in that information so I didn't get to the next steps, but I assume we've created the password based on that field, and that now that same one is what we suggest in a later "real" password field.

Aaaah, that makes sense.

The ability to ask for a new one (this bug) would solve that, but also maybe if maxlength is some ridiculously short value we should not offer to generate a "secure" password.

Or perhaps hold off on generating the password until getting a password field with a realistic length?

Either way, 'regenerate' ought to solve both problems, as well as the case where a password is rejected but — due to a poorly worded failure message — it's difficult to figure out exactly what about the generated password is deemed unacceptable. (I had one recently where it took me five or six re-readings of the message and nearly ten minutes of scrutiny and thought to realize that what it was trying, but failing, to tell me was that '-' was for some reason not deemed an allowed special character.)