1692143 - Forget primary Password / close Lockwise after a timeout

Status: RESOLVED DUPLICATE of bug 1673632

(Toolkit :: Password Manager, enhancement, P3)

Description

[Marcos Dione]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:85.0) Gecko/20100101 Firefox/85.0

Steps to reproduce:

• Open Firefox
• Go to a page for which we have stored passwords
• Lockwise prompts for the Primary Password, fill it in
• Close the tab (with or without having logging in, doesn't matter)
• Wait some time (5m)
• Open the site again.

Actual results:

• The primary Password is not Asked for again, and Lockwise remains open.

Expected results:

• After a timeout, Lockwise should close, and Firefox should ask for the Primary password again.

Comment 1

[Marcos Dione]

Go to a page for which we have stored passwords

• Go to the login page of a site for which we have stored passwords.

Close the tab (with or without having logging in, doesn't matter)

In fact, don't login, otherwise the credentials will not be asked the second time.

Open the site again.

It could be any other login page for which we have stored passwords.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Toolkit::Password Manager' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 3

[Marcos Dione]

Agreed.

Comment 4

[u681904]

The lack of this feature makes Lockwise insecure compared to other password managers. I would judge the severity as medium.

In the implementation the timeout should be adjustable. (The same timeout value could be used for remasking passwords in about:logins.)

In addition, there should be a button (similar to the "forget" button) to immediately forget the primary password.

Comment 5

[Marcos Dione]

I have a lot of free time now (laid off), so I was thinking I would give this a try. Thing is, I have never ever read any of Firefox's source code, but I can handle C/C++. Can someone give me a hint where to look?