master password asked for every login/password copied/edited/revealed in about:logins
Categories
(Firefox :: about:logins, defect, P3)
Tracking
()
People
(Reporter: u592880, Unassigned)
Details
(Whiteboard: [passwords:primary-password])
User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Steps to reproduce:
1- Set up Master password
2- Launch browser or access logins/passwords
Actual results:
Asked for master password upon launch and for every single password access
Expected results:
Ideally only asked for the master password once per session (computer session) or, at the very least, ask user whether they really want to be prompted every single time. It makes the use of Master passwords overly burdensome for common users and, therefore, really discouraging.
|
||
Comment 1•6 years ago
|
||
Bugbug thinks this bug should belong to this component, but please revert this change in case of error.
|
||
Comment 2•6 years ago
|
||
It looks like you are using a really old version of firefox. Can you go to about:support and paste the contents here?
Also, when you get the master password prompt, are you cancelling it or entering a correct password?
Hi Sam,
Thanks for your message. I am using Firefox 72.0b7, which I believe is the latest beta version, on MacOS Catalina.
Whenever I get the master password prompt, I enter a correct password. Regardless, the prompt comes back whenever I try to view/copy/edit a password.
I don't know whether this is correct behaviour or a bug; I just have the feeling that asking for the password every single time should be reserved to a higher level of security and that most people would be put off by a constant request for a long and secure master password (when once per session would be sufficient for most users).
Best,
|
||
Comment 7•6 years ago
|
||
Ah, so you're talking about access from about:logins, not from autofill, correct? You should be able to autofill for the rest of the session (unless you cancel a prompt in about:logins) after entering it once.
That's correct. The master password is requested upon launch and upon every attempt to view/copy the password in about:logins. You're right, I am able to autofill without having to re-enter the password.
Quite frankly, if I enter the password during a session, I feel it's fair to give access to other passwords and it seems excessive to ask for it at every use of about:logins. Maybe the master password could be asked once at the opening of about:logins, but not at every single password view/copy. My concern is that this will drive people away from the use of the master password.
|
|
||
Comment 9•6 years ago
|
||
(In reply to anfire@nym.hush.com from comment #8)
Maybe the master password could be asked once at the opening of about:logins, but not at every single password view/copy.
Thanks for confirming. That's what we will do in bug 1584126 shortly.
|
Reporter | |
Comment 10•6 years ago
|
||
Perfect. Happy to help!
|
||
Updated•4 years ago
|
|
||
Comment 11•4 years ago
|
||
I'm a little confused. I created the original ticket to notify the team about this issue and it's been fixed for at least two or more releases of Firefox. Now once you type the master password the first time when viewing passwords in Firefox Lockwise, you don't have to retype it for "a while". I still haven't exactly figured out when and under what conditions I have to retype it but at least now if I keep Lockwise open, I can view any password without retyping it.
|
|
||
Comment 12•4 years ago
|
||
Hi Steve, so it sounds like I can close this bug out. Thanks for that information.
As for your comment about "you don't have to retype it for 'a while'", that timeout is set to 15 minutes. So if you do not interact with about:logins for 15 minutes, then the next time you try to copy a password, edit a login, etc. the primary password prompt will appear.
Hope this helps clear things up!
|
|
||
Comment 13•4 years ago
|
||
Wonderful! Thanks for the tip about the 15 minutes and about:logins. I didn't think to look there to change it. 15 minutes is reasonable but sometimes a bit short for me. Thanks again Tim.
|
|
||
Comment 14•4 years ago
|
||
Oh, I see now that about:logins isn't where the 15 minute value can be changed. I believe I found it in about:config:
signon.masterPasswordReprompt.timeout_ms 900000
900,000 milliseconds is 15 minutes.
Thanks!
Description
•