1641391 - Protect login export behind Master Password and/or OS Reauthentication

Status: VERIFIED FIXED

(Firefox :: about:logins, defect, P1)

Description

[Matthew N. [:MattN]]

If the user has a master password set or OS re-authentication is enabled we should prompt for them before exporting.

For the OS re-auth prompt we would need two strings: one for Windows and on for macOS like the ones for reveal/copy/edit.

Comment 1

[Andrei Petcu]

What API do I need to call here? Is there an example?

Comment 2

[Matthew N. [:MattN]]

Unfortunately bug 1639347 got backed out due to test failures but if you pull that commit in locally you would use LoginHelper.requestReauth. See the examples in that bug's commit.

Comment 3

[Matthew N. [:MattN]]

Btw. we would also want the telemetry reporting for this re-auth use too.

Comment 4

[Andrei Petcu]

Attachment: Bug 1641391 Protect login export behind Master Password and/or OS Reauthentication

Depends on D77324

Comment 5

[Matthew N. [:MattN]]

Strings were approved by Meridel now:

macOS: [Firefox is trying to] export saved logins and passwords.
Windows: To export your logins, enter your Windows login credentials. This helps protect the security of your accounts.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c6b1d2548c4e
Protect login export behind Master Password and/or OS Reauthentication r=MattN,fluent-reviewers,flod

Comment 7

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/c6b1d2548c4e

Comment 8

[Simona Rosu [:srosu], Ecosystem QA]

I have verified this issue using the latest Firefox Nightly 79.0a1 (Build ID: 20200603214922) on Windows 10 x64, Ubuntu 18.04, Mac 10.14.6, Windows 7 x64.

• If a Master Password is set, the Master Password prompt is shown after clicking on the “Export” button from the “Export logins and passwords” dialog.

  • After entering the Master Password the “Export logins file” window is displayed and the logins can be saved as a CSV file.
  • The {method: reauthenticate; object: “master_password”; value: “success”} event is registered after entering the Master Password.
  • The {method: reauthenticate; object: “master_password”; value: “fail”} event is registered after canceling the Master Password prompt.

• If an OS password is set, the OS auth dialog is shown after clicking on the “Export” button from the “Export logins and passwords” dialog. (not available on Linux)

  • The “To export your logins, enter your Windows login credentials. This helps protect the security of your accounts.” title is displayed on Windows and the “[Firefox is trying to] export saved logins and passwords.” title is displayed on MacOS.
  • After entering the OS password the “Export logins file” window is displayed and the logins can be saved as a CSV file.
  • The {method: reauthenticate; object: “os_auth”; value: “success”} event is registered after entering the OS password/PIN.
  • The {method: reauthenticate; object: “os_auth”; value: “fail”} event is registered after canceling the OS auth dialog.
  • On Ubuntu, the {method: reauthenticate; object: “os_auth”; value: “success_unsupported_platform”} event is registered after clicking on the “Export…” button from the “Export logins and passwords” dialog.