1559365 - Add breach indicators to saved logins

Status: RESOLVED FIXED

(Toolkit :: Password Manager, enhancement)

Description

[Luke Crouch [:groovecoder]]

PRD: https://docs.google.com/document/d/1Vp3UbyuXCawJd-X34IuTo5TiqAbujws44XyQM4N4Z9s/edit

Locally saved browser logins should provide an indication of compromise if the login domain saved matches breaches.

Should not show an indication on any saved logins where the date last modified is newer than the breach date.

Notes:
Breach data is available via RemoteSettings "fxmonitor-breaches" key.

Comment 1

[Luke Crouch [:groovecoder]]

Attachment: Bug 1559365: UI indication of breached logins r=MattN

Comment 2

[Luke Crouch [:groovecoder]]

Still need to filter indicator by:

• Saved login date is older than breach date
• Breach included passwords

Comment 3

[Luke Crouch [:groovecoder]]

Attachment: Bug 1559365: update isOriginMatching to allow scheme-agnostic checking r=MattN

Depends on D35105

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b4f0e8b4b6fa
UI indication of breached logins r=jaws

Comment 5

[Alexandru Michis [:malexandru]]

Backed out changeset b4f0e8b4b6fa for causing browser-chrome failures in AboutLoginsParent.jsm

Backout link: https://hg.mozilla.org/integration/autoland/rev/91d8f385c5e5ec15c5cdb1d6c24b582fe1862acc

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&tochange=91d8f385c5e5ec15c5cdb1d6c24b582fe1862acc&fromchange=b4f0e8b4b6faec847999027e2cff9d5227077d21&searchStr=browser%2Cchrome&selectedJob=255028267

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=255028267&repo=autoland&lineNumber=2523

[task 2019-07-05T23:36:42.061Z] 23:36:42 INFO - TEST-UNEXPECTED-FAIL | browser/components/contextualidentity/test/browser/browser_aboutURLs.js | A promise chain failed to handle a rejection: [Exception... "Component not initialized" nsresult: "0xc1f30001 (NS_ERROR_NOT_INITIALIZED)" location: "JS frame :: resource:///modules/AboutLoginsParent.jsm :: receiveMessage :: line 186" data: no] - stack: receiveMessage@resource:///modules/AboutLoginsParent.jsm:186:24

Comment 6

[Luke Crouch [:groovecoder]]

I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1564132 so I can push to try to fix these.

Comment 7

[Luke Crouch [:groovecoder]]

I pushed my changeset to try and the tests seem to pass:

https://treeherder.mozilla.org/#/jobs?repo=try&selectedJob=255494766&revision=edba30ebe07e2ba55e926d93331256d739325315

Or else they are intermittent:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=649fbfeaaad987fa1d7e9d39242b2a7f0799ba43&selectedJob=255506257

:malexandru - Does that mean I can land these? It's been a while since I've landed code into central.

Comment 8

[Alexandru Michis [:malexandru]]

Hello Luke,
for landing patches you just need to update the phabricator revision with your new changes, wait for review and click "View Stack in Lando" and then "Preview Landing" and land. You can also just put the keyword "checkin-needed" in the bug and the sheriffs will land it.

Landing code into central directly is rarely done, most of the time code is landed into the integration trees (autoland||inbound) and later merged into central (landing code with Lando/Phabricator puts the code into autoland).

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6484c07ff836
UI indication of breached logins r=jaws,MattN

Comment 10

[Luke Crouch [:groovecoder]]

FWIW, when I click "Preview Landing" I get: " You have insufficient permissions to land. Level 3 Commit Access is required. "

Comment 11

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/6484c07ff836

Comment 12

[Lesley Norton [:lnorton]]

Attachment: Bug 1564539 Add breach alerts to login items - WIP r?jaws

Comment 13

[Phabricator Automation]

Comment on attachment 9079168 [details]
Bug 1564539 Add breach alerts to login items - WIP r?jaws

Revision D38571 was moved to bug 1564539. Setting attachment 9079168 [details] to obsolete.