1694595 - Password generator makes the same password for different accounts on same site

Status: RESOLVED DUPLICATE of bug 1551723

(Toolkit :: Password Manager, defect)

Description

[Adrian Skar]

Attachment: pass gen ff.mkv

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0

Steps to reproduce:

Use the integrated password generator when registering two new different accounts on a localhost site ( django exercise that can be found at https://cs50.harvard.edu/web/2020/projects/2/commerce/ and downloaded at https://cdn.cs50.net/web/2020/spring/projects/2/commerce.zip )

Tried on FF 86.0b9 and 87.0b1 on Windows 10 (64-bit) also on a private window.

Actual results:

The accounts and passwords were saved and function as expected but the generated password is the same for both.

Expected results:

Not sure if its a bug ( https://twitter.com/AdrianSkar/status/1364176822628470784 ) but passwords should be different.

Comment 1

[:Gijs (he/him)]

Thank you for the report! The password manager/generation team are aware of this. As a workaround, restarting the browser will change the generated password for a given toplevel domain.

The main reason this works the way it does right now is that it isn't always possible for Firefox to know if the password field is associated with a new username or the same username (and "losing" the previously generated password would obviously be annoying in that case); bug 1569568 and bug 1551723 cover creating UI to allow the user to explicitly ask for a new password.

Comment 2

[Adrian Skar]

(In reply to :Gijs (he/him) from comment #1)

Thank you for the report! The password manager/generation team are aware of this. As a workaround, restarting the browser will change the generated password for a given toplevel domain.

The main reason this works the way it does right now is that it isn't always possible for Firefox to know if the password field is associated with a new username or the same username (and "losing" the previously generated password would obviously be annoying in that case); bug 1569568 and bug 1551723 cover creating UI to allow the user to explicitly ask for a new password.

*** This bug has been marked as a duplicate of bug 1569568 ***

Makes total sense. Thank you!