253491 - master password not requested

Status: RESOLVED EXPIRED

(MailNews Core :: Security, defect)

Description

[Mr David B Weintraub]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a3) Gecko/20040728
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a3) Gecko/20040728

Installed nightly build. Started Mozilla and went to email. Not asked for master
password when mail opened. Can download new messages without password.

Reproducible: Always
Steps to Reproduce:
1. Startup Mozilla
2. Goto mail/news
3. Get messages

Actual Results:  
Downloads email from pop server

Expected Results:  
System should have reqested the master password.

Comment 1

[Felix Miata]

*** Bug 253492 has been marked as a duplicate of this bug. ***

Comment 2

[Mr David B Weintraub]

After numerous nightly updates this problem still exists. If using From Manager,
fill in form, the master password is requested after the fields are filled in. 
No action has been taken on this security but since 7/28/04.

Comment 3

[Christian Eyrich]

Did you check "Use encryption when storing sensitive data"? in
Privacy&Security/Passwords?
If not you're not gonna get asked for the password if retrieving mail or using
"Manage Stored Passwords".

That's not what I'd call the best solution but not one without the other makes
sense since without encrypting the passwords, one could still read them in plain
(reps. base64 encoded) from the .s file.
So what the bug could be about is to make this circumstance more clear to the user.

Comment 4

[Mr David B Weintraub]

(In reply to comment #3)
> Did you check "Use encryption when storing sensitive data"? in
> Privacy&Security/Passwords?
> If not you're not gonna get asked for the password if retrieving mail or using
> "Manage Stored Passwords".
> 
> That's not what I'd call the best solution but not one without the other makes
> sense since without encrypting the passwords, one could still read them in plain
> (reps. base64 encoded) from the .s file.
> So what the bug could be about is to make this circumstance more clear to the
user.

All of the above are set as you asked. I get the master password request only
when I use the form manager.

Comment 5

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 6

[Gervase Markham [:gerv]]

This bug has been automatically resolved after a period of inactivity (see above
comment). If anyone thinks this is incorrect, they should feel free to reopen it.