1558765 - Saved logins and passwords missing after update to 67.0.2 - Problem in AVG

Status: RESOLVED FIXED

(External Software Affecting Firefox :: Other, defect)

Description

[willhd]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Steps to reproduce:

update between 67.0.1 and 67.0.2

Actual results:

saved logins and passwords vanished

and import from chrome doesnt work anymore

Expected results:

a bug in the new version. I re setup 67.0.1 but nothing. this F... update deleted my login and password local file
how is it possible? where is exactly supposed to be this file in my laptop (program files firefox but where exactly I found nothing)

i think the goddamn update definitely erased the file

there are too many updates currently and we eventually got the consequences . damn!

Comment 2

[Pascal Chevrel:pascalc (PTO until April 26)]

I am wondering if this could be Firefox starting with a new profile (CCing mossop to keep him in the loop). Will, are the logins/passwords the only thing missing? Do you have multiple profiles in about:profiles?

Comment 4

[[e-mail]]

Also, after re-entering logon IDs and passwords to get into various web sites, it seems that FF now won't remember newly entered ID/passwords.

Comment 5

[willhd]

I have only one profile and I am never connected

yes this is the only thing missing , i still have my bookmarks, my add ons and all parameters were kept

Comment 6

[Matthew N. [:MattN]]

Please try to move pkcs11.txt from your profile folder to the trash (keep a copy in case we need to inspect it). You can find your profile folder using the button in about:support (load that URL in the browser).

Logins are saved in logins.json in that same folder and the encryption key is stored in key4.db.

Can you please attach debug logs from after setting the debug pref. and restarting Firefox. Then load chrome://passwordmgr/content/passwordManager.xul and attach the logs as a file here.

Comment 7

[[:philipp]]

more reports at:
https://support.mozilla.org/en-US/questions/firefox?owner=all&tagged=bug1558765&show=all
https://old.reddit.com/r/firefox/comments/bzlf8n/help_lost_all_passwords_when_updated_to_firefox/

Comment 8

[willhd]

I am not an IT guy but this update seems to be a mess

I am gonna try to install the previous version

with the update,

I saved new logins and passwords but it disappeared when firefox closes

and instead I click to save some cookies, firefox deletes it when it closes meaning the soft is doing the opposite

Mozilla is dope and a meaningful project, I am very aware of how it works (open source community) but committee must care about not releasing too many updates too often esepcially when some is a mess. Only la SNCF (worst French company does it in France) is a specialist of this

Comment 10

[Michael]

I can confirm this behaviour. Reported the same bug here: https://bugzilla.mozilla.org/show_bug.cgi?id=1559089

The update installs just fine, but after restarting Firefox, the logins.json file shows up as logins.json.corrupt. Deinstalling 67.0.2 and reinstalling 67.0 works the very same (renamed) logins.json file immediately.

Comment 11

[[:philipp]]

multiple affected users at https://www.camp-firefox.de/forum/thema/128151-nach-letztem-update-sind-alle-gespeicherten-passwörter-verschwunden/ have linked the issue with the corrupted logins.json file after a reboot to the presence of avg security software (probably avast as well) - is this the case for you as well?

Comment 12

[Michael]

(In reply to [:philipp] from comment #11)

multiple affected users at https://www.camp-firefox.de/forum/thema/128151-nach-letztem-update-sind-alle-gespeicherten-passwörter-verschwunden/ have linked the issue with the corrupted logins.json file after a reboot to the presence of avg security software (probably avast as well) - is this the case for you as well?

Indeed. The machine in question is runing AVG Internet Security. Which still makes me wonder why it should work with 67.0, yet fail with 67.0.2 :-)

Comment 13

[[:philipp]]

hi lukas, fyi your product seems to be involved in corrupting the firefox password storage on system reboots since recently.

Comment 14

[Pascal Chevrel:pascalc (PTO until April 26)]

Marking as New as we have several reports, tracking for all releases in flight.

Comment 15

[Virginia (please send need info request to Brindusa Tot)]

Hi team,

I was able to reproduce this issue on Windows 7 x64 by doing the following steps:

1- installed AVG latest version 19.5.3093 (build 19.5.4444.503) UI version: 1.0.171
2- installed firefox release version 67.0.1 and signed in facebook.
3- updated to firefox 67.0.2
4- Reboot
5- open ff 67.0.2 : previously opened tab with facebook logged in was opened. When looking at the Saved Logins, I should have the one from facebook, but it's empty.

I'll attach screenshots for reference.

Please note that I was only able to reproduce it after rebooting the machine. If you don't reboot, saved logins appear on 67.0.2.

Comment 16

[Virginia (please send need info request to Brindusa Tot)]

Attachment: Capture 67.0.2 Win7 version 2.JPG

firefox 67.0.2 after rebooting, saved passwords have been deleted

Comment 17

[Pablo]

UPDATE: On windows 10 64bit i WAS able to reproduce the issue too.

Windows 10 pro 10.0.17134 build 17134
Installed AVG 19.5.3093 (build 19.5.4444.503)
installed Firefox 67.0.1
saved gmail password and also firefox sync account
updated to 67.0.2, clicked restart in "help> about firefox"
then did a PC reboot while keeping Firefox window OPEN

When windows10 rebooted, firefox window showed atomatically, i checked the passwords in "Open menu> Logins and passwords" and the list appeared.

But AVG is kind of slow to start and takes time to fully load, but after AVG fully loaded, the "open menu > logins and passwords" showed empty

Comment 18

[Pablo]

For windows 10 there is a better way to replicate since after rebooting the pc sometimes shows the logins and sometimes it does not.

-Delete profiles and firefox folders
-Install AVG
-Install Firefox release Setup 67.0.1.exe
-launch firefox, enter Gmail account and leave gmail window open
-REBOOT THE PC with firefox window open
-Wait for firefox window to appear and wait for AVG to fully load
-Check "open menu > logins and passwords" (password is showing up)

• Update "help>about firefox" and click restart firefox button
• Firefox launches again is updated to 67.0.2 and logins and passwords are not there anymore.

Comment 19

[Lukas Rypacek]

Hi,
Thank you for reporting this. The AVG team has been able to identify the source of the problem in one of the AVG features (password protection). The product protects users from the risk of stolen passwords stored inside Firefox and other browsers. For Firefox, it only allows the process signed by Firefox certificate to access the storage.

We have been able to identify a problem with propagating the certificate trust to all our systems. FF 67.0.2 is signed by the newly issued certificate valid from 5/31/2019 and the problem most probably is caused by this. We have manually fixed our internal certificate flags on our backends and updated the process for future certificate updates (expecting no later than 6/4/2020 )

New installations of AVG should be fixed right away, for existing users we are issuing the fix through a virus DB update that should be out within a couple of hours. The updated VPS version number is '19061402'. The current virus DB version can be checked in the following file "C:\Program Files\AVG\Antivirus\defs\aswdefs.ini"

Thanks!
Lukas.

Comment 20

[Peter]

This has affected me too. Please could somebody confirm : are the lost saved logins are gone forever or is there a way of retrieving them?

Comment 21

[Romain Testard [:RT]]

Thanks Lukas, a few clarifying questions:

• How long does it take for the virus Db update to reach most of your users? What is the process to fix the issue once the update is received? (restart Firefox? Restart the OS?)
• Will existing users who had lost their passwords retrieve it?
• What is VPS?

Comment 22

[Frederik Braun [:freddy]]

Adding a SUMO article and problematic software names to hopefully make it easier for affected users

Comment 24

[Lukas Rypacek]

• The update is normally checked every 4 hours, users can issue manual virus DB update from AVG / Settings / Update. No action is expected from the user after the update. The update has already been released and is being distributed to the userbase.

• VPS == virus DB

• the issue did not affect Avast users, only AVG users that have purchased the standalone "AVG Password Protection" product.

• AVG does not modify the file nor does it delete it. It only prevents Firefox from reading from it. From our understanding, FF renames the logins.json file to logins.json.corrupt upon subsequent retries to logins.json-1.corrupt, logins.json-2.corrupt and so on. I am not sure right now if there is any mechanism to recover these passwords back from inside FF. Renaming this file (copy) back to logins.json restores Firefox ability to read it again.

Comment 25

[Lukas Rypacek]

Could you, please, update the summary and remove AVAST from the title? It hasn't been reproduced with Avast AV and the mentioned feature "AVG Password Protection" is not offered for AVAST users. Thanks a lot.

Comment 26

[Michael]

It should be noted that this problem does also affect users with AVG Internet Security installed, even if they have not bought the additional Password Protection option from AVG. The updated VPS seems to have cured it, though.

Comment 27

[Ivan]

(In reply to Lukas Rypacek from comment #24)

• The update is normally checked every 4 hours, users can issue manual virus DB update from AVG / Settings / Update. No action is expected from the user after the update. The update has already been released and is being distributed to the userbase.

• VPS == virus DB

• the issue did not affect Avast users, only AVG users that have purchased the standalone "AVG Password Protection" product.

• AVG does not modify the file nor does it delete it. It only prevents Firefox from reading from it. From our understanding, FF renames the logins.json file to logins.json.corrupt upon subsequent retries to logins.json-1.corrupt, logins.json-2.corrupt and so on. I am not sure right now if there is any mechanism to recover these passwords back from inside FF. Renaming this file (copy) back to logins.json restores Firefox ability to read it again.

Hello,

I am not using AVG or AVAST, but have the same issue. I use Windows Defender instead. What should be the fix for my Firefox.

Comment 28

[[:philipp]]

@Ivan: please open a support question about this problem at https://support.mozilla.org/en-US/questions/new as your problem won't be related to this bug.

Comment 30

[Liz Henry (:lizzard) (relman/hg->git project)]

Here is a SUMO article describing the workaround to recover passwords affected by this bug: https://support.mozilla.org/kb/passwords-disappearing-avg-security

Comment 31

[Peter Dolanjski [:pdol]]

Lukas, can you have AVG support point people to the official add-on we built to fix the issue? https://addons.mozilla.org/firefox/addon/restore-logins/

Comment 33

[Peter]

(In reply to Liz Henry (:lizzard) (use needinfo) from comment #30)

Here is a SUMO article describing the workaround to recover passwords affected by this bug: https://support.mozilla.org/kb/passwords-disappearing-avg-security

Thank-you!

Comment 34

[Pascal Chevrel:pascalc (PTO until April 26)]

Fixed by an AVG update.