2069704 - Insecure password prompt appearing on local IPs

Status: UNCONFIRMED

(Firefox :: Security, defect, P3)

Description

[Tom J]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0

Steps to reproduce:

Visit a local IP site (10.0.0.0/24 in my case, router login page).
Click in the password box

(default true setting of security.insecure_field_warning.ignore_local_ip_address)

Actual results:

Insecure password prompt pops up despite preference security.insecure_field_warning.ignore_local_ip_address being 'true'

Expected results:

No password insecure pop up on local IP sites

Comment 1

[Tom J]

Attachment: Insecure prompt displaying on local IP site

Comment 2

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Toolkit::Password Manager' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Tom J]

(In reply to BugBot [:suhaib / :marco] from comment #2)

The Bugbug bot thinks this bug should belong to the 'Toolkit::Password Manager' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Moved back to Firefox and selected Security as the component. The issue is not related to password managers as the bugbot suggested. It is a security related issue, but ironically is not one that lessens security.

Comment 4

[Manuel Bucher [:manuel]]

InsecurePasswordUtils is owned by 'Toolkit::Password Manager', so the BugBot was at least somewhat correct. (See https://searchfox.org/firefox-main/rev/9779d0c588762208f33a82c9fc710f81466f6e9e/toolkit/components/passwordmgr/InsecurePasswordUtils.sys.mjs#131). However, the bug introducing this pref (Bug 1337246), was indeed in this component. I'll keep it here for now. I haven't had the time to confirm yet.

Comment 5

[Maryam]

Hi Tom, I tried reproducing with a minimal html page containing a password field served at a local IP, with security.insecure_field_warning.ignore_local_ip_address set to true. I don't see the popup you're describing. Could you attach the HTML of your router login page? I want to confirm whether the popup you're seeing is triggered by something specific to that page that my test cases don't cover.

Comment 6

[Tom J]

After further investigation, I've identified that it's limited to hostnames attached to local IPs, rather than local IPs themselves. When directly visiting the local IP (10.0.0.1) in my case, there's no prompt, but when visiting http://router/ for example, the prompt shows despite this IP being mapped to 10.0.0.1 via the DNS. It seems the logic may need to be updated to look at the actual IP it's connecting to rather than the URL itself.

Thanks!

Comment 7

[Maryam]

Oh yeah, that's the intended behavior. See bug 1337246 comment 51

Comment 8

[Tom J]

Maybe it would be an improvement to the experience if a site could be added individually to a whitelist or could be marked as ‘trusted’.

Comment 9

[Tom J]

(In reply to Maryam from comment #7)

Oh yeah, that's the intended behavior. See Comment 51 under Bug 1337246

It seems comment 51 seems to show that the behaviour is not expected now for hostnames on local IPs

Comment 10

[Maryam]

A case like http://router/ still gets the warning, it was knowingly excluded for security purposes