1773540 - Resetting the Windows password using a tool does not erase stored credentials

Status: RESOLVED DUPLICATE of bug 1636789

(Firefox :: Security, enhancement)

Description

[Jonas Sauge]

Attachment: bugzilla_firefox.pdf

Hi

This is the first time i open something like this and i'm not sure, whether this has a place there or not, even after a carefull read.
This so please have that in mind :-)

This has been tested and reproduced in a Windows 10 21h2 VM using UEFI boot.

Doing so, i've discovered that for both Chrome and Edge, after the reset of the password, the registered credentials have been wiped and are not listed anymore in the browsers password , but not for Firefox.

This looks to be related to the deletion / activation of password as i can reproduce this when the user has no password (crendentials exists) defining a password makes the stored credentials being deleted as after a reset.

Please find attached a pdf containing some screenshots of the process and browsers, before and after a reset of an user password using the tool.

TLDR: in case of a computer / hdd get compromised there's an easy access to any credentials stored by Firefox

If you need more informations or tests, i'd be happy to help you.

Regards,

Jonas Sauge

Comment 1

[Jonas Sauge]

Sorry for my bad english, accidentaly submitted before corrections.

Comment 2

[Jonas Sauge]

Attachment: bugzilla_firefox.pdf

Comment 3

[Dana Keeler (she/her) [:keeler]]

Thanks for the report. Currently, Firefox's mechanism for storing passwords is distinct from OS authentication methods, so resetting a user account's password won't clear any passwords in Firefox. In other words, this is expected behavior. It would be nice to make use of the OS for things like this, though.

Comment 4

[Jonas Sauge]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #3)

Thanks for the report. Currently, Firefox's mechanism for storing passwords is distinct from OS authentication methods, so resetting a user account's password won't clear any passwords in Firefox. In other words, this is expected behavior. It would be nice to make use of the OS for things like this, though.

*** This bug has been marked as a duplicate of bug 1636789 ***

Thanks for the explanation.
That was my guess but couldn't find a duplicate of this.

Sorry to bother you, but can you please delete the obsolete attachement?

Regards

Comment 5

[Dana Keeler (she/her) [:keeler]]

(In reply to Jonas Sauge from comment #4)

Sorry to bother you, but can you please delete the obsolete attachement?

I personally can't delete it, but I hid it (only users with security access can see it now). Is there something sensitive in it that would warrant removing it more thoroughly?

Comment 6

[Jonas Sauge]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #5)

(In reply to Jonas Sauge from comment #4)

Sorry to bother you, but can you please delete the obsolete attachement?

I personally can't delete it, but I hid it (only users with security access can see it now). Is there something sensitive in it that would warrant removing it more thoroughly?

No i guess it's ok like this - sorry for the inconveniance.

Regards.