1820360 - Use new generated password after previous is saved in password manager

Status: RESOLVED FIXED

(Toolkit :: Password Manager, enhancement, P1)

Description

[Sergey Galich [:serg]]

Today when we generate a password for some origin, it's placed in the in-memory cache and stays there until browser restart. The intent was to make sure users don't lose generated password while they navigate through registration pages.

The flaw here is that when user creates a new account on the site where they recently created another account, we will keep giving them the same generated password. Which leads to password reuse.

We also autosave generated password right at the time of filling into a login without username.

This bug resets generated password when autosaved login is updated with username. By that time, user already has generated password stored and there is no value in preserving cached generated password.

Comment 1

[Sergey Galich [:serg]]

Attachment: Bug 1820360 - Use new generated password after previous is saved in password manager r=#credential-management-reviewers

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6438ef985f55
Use new generated password after previous is saved in password manager r=dimi

Comment 3

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/6438ef985f55