1714215 - intrusive primary password dialog

Status: NEW

(Firefox :: about:logins, enhancement, P3)

Description

[coderman64]

Attachment: A Mockup for a less intrusive primary password dialog

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0

Steps to reproduce:

Open up Firefox with Primary Password enabled, start browsing immediately

Actual results:

The primary password authentication box appeared over my web content, taking focus away from the webpage. This can be annoying for some users and may discourage users from using the primary password feature despite its security benefits.

Expected results:

The browser should prompt the user to enter the primary password via an unobtrusive notification on the navigation bar (similar to the "save password" box). Allowing the user to click on the box and type their primary password when they want to use features relating to a firefox account (such as sync and lockwise).

A mockup is included as a .png file.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::about:logins' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Timea Cernea [:tbabos][inactive]]

Hi coderman64,
I will mark this as a New enhancement for the Primary Password prompt so the developers can take a look at it. Thanks for the report!

Comment 3

[Sam Foster [:sfoster] (he/him)]

Thanks for filing this. You are totally right that the primary password experience could be much improved. It is abrupt, interrupts interaction with the page and the reason why the prompt pops up is often unclear. Further, people's expectations around what primary passwords do and don't protect from vary wildy, so everyone wants it to behave differently. I think any work to improve this experience will need to be done in the context of a larger evaluation of privacy and security user experience around passwords, and to that end suggestions like this are encouraged.

I'm going to flag this bug as "feedback", not to shut down the discussion, but to get it moved to a better venue.

Comment 6

[Markus Keller]

The fix for the Primary Password dialog should solve 3 problems:

1. intrusive page-modal popup (this bug and dups)
2. spoofable visuals, see bug 101611: It's a security problem to render the password dialog in the web page content area and not outside of it in the browser chrome. The dialog must be shown outside of the website-controlled area, e.g. in a "doorhanger" from the awesomebar.
3. with multiple open windows, the dialog is sometimes hidden in a window that is not in front. Currently, the only workaround is to manually activate every Firefox window in order to find the one with the dialog.