1629059 - Firefox still asks for the smarcard password after the card has been removed

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Laurent Bigonville]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0

Steps to reproduce:

0. On linux load opensc-onpin module in firefox
1. Go to a website that uses the client certificate present on the smarcard
2. FF opens a dialog to ask about the password of the key
3. Remove the smartcard
4. Browse to an other website that also use a (different) client certificate

Actual results:

Firefox still asks for a password for the smartcard that has been removed

Expected results:

Firefox sees that the smartcard is not present anymore and don't ask for any pin

Comment 1

[Laurent Bigonville]

The Opensc module entry in security device panel in the preferences properly shows whether there is a smartcard present or not

FTR, it's opensc 0.20.0

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Does this build fix the issue for you? https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/WzmbGiRtT1-UT3dCyjc-Tg/runs/0/artifacts/public/build/target.tar.bz2

Comment 4

[Firefox Bug Husbandry Bot]

Resetting severity to default of --.

Comment 5

[Laurent Bigonville]

75 is still affected but it looks like that the build above is OK

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: Bug 1629059 - don't attempt to authenticate to tokens that aren't present r?beurdouche

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/13ce97c56e6e
don't attempt to authenticate to tokens that aren't present r=bbeurdouche

Comment 8

[Laurent Bigonville]

Little question here, the certificate of the smartcard is not listed in the list of acceptable client certificate on the other website I'm going. Is that expected that it's even trying to get the key from the smartcard?

FTR, the other website I'm browsing to in step 4) is https://tracker.debian.org, openssl only shows one "Acceptable client certificate CA names":
CN = SSO CA 2015-08-21, O = Debian SSO client certificate

Comment 9

[Laurent Bigonville]

To be complete, I do have a certificate that matches that CA on my machine, just not on the smartcard

Comment 10

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/13ce97c56e6e

Comment 11

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

(In reply to Laurent Bigonville from comment #8)

Little question here, the certificate of the smartcard is not listed in the list of acceptable client certificate on the other website I'm going. Is that expected that it's even trying to get the key from the smartcard?

FTR, the other website I'm browsing to in step 4) is https://tracker.debian.org, openssl only shows one "Acceptable client certificate CA names":
CN = SSO CA 2015-08-21, O = Debian SSO client certificate

If I understand your question, yes, that is the expected behavior at the moment.

Comment 12

[Bogdan Maris, Desktop QA]

Laurent, would you be comfortable to verify that this is no longer an issue for you on latest Firefox Beta build? Download link: Here

Comment 13

[Laurent Bigonville]

Firefox 77 final seems to fix my issue, thanks