1874567 - Suggested "secure" password too short; should be a way to specify min length

Status: RESOLVED INCOMPLETE

(Toolkit :: Password Manager, defect)

Description

[[:jberkus] Josh Berkus]

Attachment: Pasted image.png

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0

Steps to reproduce:

1. Started to create a new online banking account.
2. Had to create a UserID and password for the account
3. Clicked on the password field and looked at FF's password suggestions

Actual results:

4. The password suggested by FF's password manager was "58Tf" which was way too short for the rules of the banking site (as it should be)
5. There was no way to change the minimum password length or ask FF to regenerate

Expected results:

4. Firefox should have suggested a reasonable minimum length password (e.g. 8 characters)
5. There should be a way for the user to configure this minimum length which overrides any metadata from the webform.

Comment 1

[[:jberkus] Josh Berkus]

Given how the password suggestor works, I suspect that the bank's webform had some kind of bad metadata on the password blank that made FF think that 4 chars was the maximum length. Unfortunately, I had a time limit so I couldn't probe deeply enough into the JS for the page to confirm this. Since other mangled webforms exist, and will always exist, though, the obvious solution is to allow the user to set a minimum password length (and maybe other parameters) that overrides anything from the webform.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Toolkit::Password Manager' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:serg, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Sergey Galich [:serg]]

:jberkus thanks for letting us know of this problem, can you provide a link to that web page so we can investigate? If I remember correctly default rules have 12 chars per password, so that must be some sort of misconfiguration.

Comment 5

[[:jberkus] Josh Berkus]

Unfortunately, I cannot. It was a private page for my corporate credit card access; there's no way for you to access it. And the interface was just for new accounts, so I can't go back to it either.

I do think it was something about the webform, though, because the password suggestor continues to work normally on other sites.

Comment 6

[Sergey Galich [:serg]]

I see, unfortunately there isn't much we can do about it without seeing what's going on.
If you happen to be there again and capture HTML of that form/inputs (without personal data) - please attach it and reopen this bug. Thank you.

P.S. Linking Bug 1650312 for the idea to allow user to customize generated length.