Firefox Lockwise doest seems to Authenticate user before showing password
Categories
(Firefox :: about:logins, defect)
Tracking
()
People
(Reporter: vigneshwaransivasamy, Unassigned)
Details
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:70.0) Gecko/20100101 Firefox/70.0
Steps to reproduce:
- Install Firefox browser
- Now create an account in firefox
- Save credentials in firefox
Actual results:
Credentials saved can be viewed directly without authenticating the user.
Expected results:
Everytime user wants to see the password, he should be authenticated with master password
|
Reporter | |
Comment 1•6 years ago
|
||
This issue may stop users from saving credentials in firefox, as anyone peek into the machine and look into someone else credentials without any problem.
|
|
Reporter | |
Updated•6 years ago
|
|
||
Comment 2•6 years ago
|
||
Matt, can you help triage? Thanks.
|
||
Comment 3•6 years ago
|
||
This sounds like a duplicate of bug 1261977 or bug 1194529.
(In reply to vigneshwaransivasamy from comment #0)
Everytime user wants to see the password, he should be authenticated with master password
That is what happens if the user enables Master Password: https://support.mozilla.org/kb/use-master-password-protect-stored-logins
|
||
Comment 4•6 years ago
•
|
||
IMO, this bug shouldn't be a dupe after bug 1261977. As I see it, about:logins should offer a basic layer of protection in the lack of a master password. I've seen the OS password being requested in some password managers (don't recall exactly on what OS/browser).
The simplest use case I can think of is that somebody is allowed temporary access my computer - let's say family visiting. It's weird to be concerned that my brother or anyone for that matter could have plain text access in 3 clicks to any of my saved credentials, even though he only has temporary access.
|
|
||
Comment 5•6 years ago
|
||
(In reply to Adrian Florinescu [:adrian_sv] from comment #4)
The simplest use case I can think of is that somebody is allowed temporary access my computer - let's say family visiting. It's weird to be concerned that my brother or anyone for that matter could have plain text access in 3 clicks to any of my saved credentials, even though he only has temporary access.
They'd have that access anyway if they wanted to; they could copy the files off disk with a usb stick they brought, etc. etc.
The situation you describe is what the "guest" account on the OS was designed for.
|
|
||
Comment 6•6 years ago
•
|
||
While comment 5 statement is totally correct, it's also unrealistic - it would require the "attacker" to have minimal knowledge about profiles and password manager. Therefore, I feel that the approach to the problem is that if there's intent and premeditation, there's nothing can be currently done, so we either do bug 1261977 or do nothing. But the point I was trying to make is that it is way too easy to access the user's credentials on a default setup.
|
|
||
Comment 7•6 years ago
|
||
(In reply to Adrian Florinescu [:adrian_sv] from comment #4)
IMO, this bug shouldn't be a dupe after bug 1261977. As I see it, about:logins should offer a basic layer of protection in the lack of a master password. I've seen the OS password being requested in some password managers (don't recall exactly on what OS/browser).
Chrome does this and bug 1194529 is on file for that.
Description
•