1825926 - Stored passwords become invalid on each Thunderbird update - until I remove the empty shader-cache directory.

Status: RESOLVED INCOMPLETE

(Thunderbird :: Security, defect)

Description

[Fabian.Hofsaess]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0

Steps to reproduce:

The only thing I did to make the issue appear is that I updated Thunderbird.

In more detail:
I started Thunderbird, which then (successfully) checks mails for several email accounts. When opening Help -> About Thunderbird, an update has been offered. I chose to install the update.
After the update had been installed and Thunderbird restarted, emails could not be checked any more because password manager did not remember passwords any more / asked for passwords again.
Even worse: After entering a password, emails are not downloaded and the entered password is not stored.
After several hours and days of trial and error, I found a workaround. It does not avoid the issue, and it needs passwords to be re-entered, but it at least allows to store passwords in password manager again:
I noticed that on each update, the shader-cache directory is empty. It still exists, but its content is removed.
When removing the complete folder, and then starting Thunderbird, passwords will be stored again after being re-entered.
Still, it is annoying to re-enter every password after each update.

I'm currently using Thunderbird 102.9.1 (32 bit, Windows), but this issue happens on every Thunderbird update for several months / several versions now.
The last update it happened was 102.9.0 to .1, but all updates I had installed for a while showed the issue.
I'm sure I noticed the issue when updating to version 100, but I'm not sure if this has been the first occurrence. Anyways, the issue persisted on my last update.
I have my profile stored on a network folder. Not sure if this has to do with the issue.

The bad news is that I also have Thunderbird on another machine, with a locally stored profile, where the issue does not occur.
Thus the exact how-to-reproduce is unknown. It may or may not depend on profiles in a network folder. It may or may not depend on something in my profile.
As there is no deterministic how-to-reproduce, investigation could start with the shader-cache directory. Is it supposed to be emptied during or after update? Why is it a problem if it exists, but is empty, whereas it is not a problem when it is completely missing? Why / in which way does this affect the password manager?

I did some research and followed some community tips.
It included removing files like cert8.db, cert9.db, key3.db, key4.db, pkcs11.txt, secmod.db, etc.
None of those helped.
Only removing the (after the update: empty) shader-cache directory helped.

I'm not sure if the root cause for the issue is during the update, or on restart. It shows on re-start, that's all I know. I don't know if an update is supposed to empty the shader-cache directory, or if it shouldn't.

Actual results:

After the update had been installed and Thunderbird restarted, emails could not be checked any more because password manager did not remember passwords any more / asked for passwords again.
Password manager is not able to remember re-entered passwords until I remove the empty shader-cache directory.

Expected results:

After the update password manager should still remember stored password and email check should still work "out of the box".

Comment 1

[Wayne Mery (:wsmwk)]

Fabian, do you still experience this when using version 128?

Comment 2

[Phoenix]

Resolved per whiteboard