1846314 - Unsigned builds continuously prompt for keychain password when accessing logins/creditcards/syncing etc

Status: RESOLVED INVALID

(Toolkit :: Form Autofill, defect)

Description

[Micah [:mtigley] (she/her)]

Steps to Reproduce

1. On a new profile, save a credit card from about:preferences
2. Firefox will prompt for keychain password. Click "Allow"

Expected

Credit card is saved when keychain password is successfully authenticated.

Actual

Firefox will prompt the user several more times for the keychain password even though it was successful the first time.

Some notes: this issue goes away when clicking "Always Allow".

Comment 1

[Mark Hammond [:markh] [:mhammond]]

Similar experience when syncing (and I think even when uploading existing local cards, so not limited to saving) - but let's see if that gets fixed as a side-effect of fixing this before we open a secondary issue.

Comment 2

[Dimi Lee [:dimi]]

It seems that every OSKeystore API call that requires accessing "Firefox Encrypted Storage" keychain access triggers two prompts, and the result is not cached so if we call the API multiple times, each API calls trigger two prompts.

For example, if users save a credit card, then the user will see 4 prompts:

1. Formautofill module calls encrypt to encrypt the credit card number
2. Trigger the 1st prompt because ensureLoggedIn -> nativeOSKeyStore.asyncSecretAvailable

• The dialog says "Firefox wants to use your confidential information stored in Firefox Encrypted Storage in your keychain"

3. After the user types the password and presses ok, then the 2nd prompt appears, with a little bit different description in the dialog

• The dialog says "Firefox wants to access key Firefox Encrypted Storage in your keychain"

4. ensureLoggedIn finishes, but triggers the 3rd prompt because of nativeOSKeyStore.asyncEncryptBytes
5. The same as step3, after the user types their password, another dialog appears (4th)
6. Encrypt finishes

Note. This doesn't seem to be recent regression, I tried Fx106 and I could still this issue, maybe this is caused by an OS updated?

Hi dana,
This issue is quite annoying for users, is anyone in your team could help take a look at this bug? Thanks!

Comment 3

[Dimi Lee [:dimi]]

Attachment: 1st prompt.png

Comment 4

[Dimi Lee [:dimi]]

Attachment: 2nd prompt.png

Comment 5

[Mark Hammond [:markh] [:mhammond]]

From a discussion in slack, it seems the dialogs shown in those screen-shots only happen with local builds, not with official builds. I'm guessing the distinction might be more like "signed" vs "unsigned" builds, and that it's the OS showing this dialog?

Comment 6

[Dana Keeler (she/her) [:keeler]]

Yeah, this is an OS thing. I'm not aware of anything Firefox can do to affect this behavior when unsigned. I recommend using "Always Allow".

Comment 7

[Mark Hammond [:markh] [:mhammond]]

I think my comment on slack caused this to be opened - thanks! But there's nothing for us to do here.