1906831 - Saved Passwords not protected by fingerprint if left open when you close phone or switch to another app

Status: RESOLVED DUPLICATE of bug 1904652

(Fenix :: Logins, defect)

Description

[Christiaan Swiers [:YouGina]]

Attachment: New passwords menu item.jpg

Summary

Until recently when I wanted to access passwords I would go to click the 3 dots next to the address bar, go to settings, then passwords, and then "Saved passwords". At this point you will have to authenticate and then the passwords will be shown. After this, if you leave the screen open, and android will auto-lock your phone, you will have to re-authenticate after you open your phone again.

Now I noticed there is a new option "Passwords" directly when you click the 3 dots next to the address bar. When opening here, you still have to authenticate before the passwords will be shown. The problem is however that when you lock your phone, or when it locks automatically, the passwords view will not be locked. After unlocking the phone the last accessed password is still visible and you can also still access any of the other passwords.

Steps to reproduce

• Open the passwords via the new "passwords" menu item, directly after clicking the 3 dots next to the address bar in the bottom of the screen
• Authenticate when asked for it
• Open any account and display the password
• Lock the phone
• Reopen the phone
• Note that the password is still visible

Impact

The difference in behavior made me decide to report. While in most cases you will still need to authenticate to the phone it is at least concerning that any passwords you had displayed before are now still visible on the screen.

Comment 1

[Daniel Veditz [:dveditz]]

I noticed that too -- confirming

Comment 2

[Daniel Veditz [:dveditz]]

Also it should re-ask for the password if you switch apps and then switch back.

Comment 3

[Daniel Veditz [:dveditz]]

going to unhide this because it's not a remote "attack", and if public maybe some people can protect themselves (by making sure they exit that screen right away)

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

Comment 5

[Chris Peterson [:cpeterson]]

The new Passwords menu item was added in Fx 127 by bug 1887600.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

:avirvara, since you are the author of the regressor, bug 1887600, could you take a look?

For more information, please visit BugBot documentation.

Comment 7

[Chris Peterson [:cpeterson]]

Alexandra, do you know why the password manager’s unlock security would work differently when the password manager is opened from the three dot menu’s Passwords menu item (bug 1887600) than from the Settings menu’s Passwords menu item?

Comment 8

[Alexandra Virvara]

yes, this is a duplicate of https://bugzilla.mozilla.org/show_bug.cgi?id=1904652. There is a work in progress patch for it.