1652486 - Password generation generates the same password for the same site every time

Status: RESOLVED DUPLICATE of bug 1551723

(Toolkit :: Password Manager, defect)

Description

[aydinnyunus]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

Steps to reproduce:

I give example for Tesla.com but it's working on all register forms (like Register on Facebook,Twitter etc.).

Summary

When I register on auth.tesla.com it generates same suggested password everytime.In addition the page contains a form with the following action URL:
https://auth.tesla.com/register?redirect_uri=https://forums.tesla.com/

*Part of 1.Request : *

first_name=Yunus&last_name=Aydin&username=&phone=&email=aydinnyunus%40gmail.com&password=V5M9VaX99uyTtsr

*Part of 2.Request : *

first_name=Yunus&last_name=Aydin&username=&phone=&email=testtesqwe123312%40gmail.com&password=V5M9VaX99uyTtsr

Steps to Reproduce:

1.Go to the vulnerable link : https://auth.tesla.com/register?redirect_uri=https://forums.tesla.com/

2.Create an account with suggested password.

3.Now you are on forums.tesla.com on the new tab go to the vulnerable url again.

4.Create an account with suggested password again.

5.Compare the passwords.

V5M9VaX99uyTtsr == V5M9VaX99uyTtsr

Impact

The victim creates accounts with the same passwords.If attacker find any passwords of victim.Attacker will enter all of the victim's accounts on tesla.

Actual results:

The suggested passwords given to me when I register on the site are the same

Expected results:

They must be different.If not attacker can steal all passwords.

Comment 1

[Matthew N. [:MattN]]

This is intentional and similar to bug 1621599. You can use separate containers, separate private windows or restart Firefox between generating passwords to have it work how you want. We will add an option to generate a new password to make this more clear.