2031001 - I can no longer use my primary password to access my stored passwords, instead it tries to use the windows password

Status: RESOLVED WORKSFORME

(Toolkit :: Password Manager, defect)

Description

[Robert Relyea]

After updating to Firefox 149, the saved password system is causing all sorts of issues:

1. It's often not including the correct password when I need to log in. This caused accounts to get locked because of too many login attempts.
2. When I look at saved password, it doesn't prompt for my primary password, but the Windows os password. This confused my wife because 1) she had no idea what that 'PIN' was, and 2) once I explained to her what that password was, she was furious. We have care givers that my need to access the computer, but she doesn't want them to access the passwords. The using windows os to authenticate to the password database completely compromises her security expectations. The appears to be no way to return to the previous semantics. This is a hi priority security issue for her.

Comment 1

[Manuel Bucher [:manuel]]

It looks like the behavior changed in bug 1991050. Moving to password manager component for further triage. Setting as regressor, feel free to change if not appropriate (could also be see_also).

Comment 2

[BugBot [:suhaib / :marco]]

:simonf, since you are the author of the regressor, bug 1991050, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1991050

Comment 4

[Simon Friedberger [:simonf]]

Robert, do you get the intended behavior when you disable the OS auth check by unsetting "Require device sign-in to manage passwords"?

Comment 5

[Robert Relyea]

No, I no longer prompts me for any passwords to see the underlying passwords (I was expecting the primary password prompt). Even if the default is to use the OS password, we need a way to switch back to the primary password prompt. As I said, the OS password is known to people who may use the computers, but we don't want them to extract the passwords.

Also we still don't get proper matching to finding the correct password (currently my wife is cutting and pasting the passwords from the password dialog into the password window... It's acting as if the name of the website has changed, but it's showing up correctly).

The second problem may be a separate issue from the first.

Comment 6

[Robert Relyea]

OK, I've tried clicking the OS check again and this time I'm seeing the correct behavior, but It's still not filling password prompts with known passwords.

Comment 7

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1991050

Comment 8

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:mtigley, could you have a look please?

For more information, please visit BugBot documentation.

Comment 9

[Robert Relyea]

OK, I've tried clicking the OS reset again, and it's working now. I was able to check the other settings and found the setting that autofills was turned off. Once I got those set, things are working correctly now, so I'll close the bug. It's not clear how the other setting got flipped, but I'm not sure that issue can be reproduced.