262413 - passwords can be made visible too easily

Status: VERIFIED DUPLICATE of bug 259996

(Core :: Security, defect)

Description

[Simon Brouwer]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10

If somebody has a moment of unattended access to my PC, he/she can easily
retrieve the password to my e-mail accounts (Tools - Options - Advanced - View
password - button "Show Passwords"). The dialog "Are you sure you wish to show
your passwords?" is superfluous, in any case it doesn't provide any additional
security. 

Of course I know you can set a master password, but that also means I have to
input the master password every time I start Thunderbird, which is inconvenient. 

For the convenience of not having to input a password everytime, I am quite
willing to accept that somebody could sit behind my PC and read some of my
e-mail, risking to be caught. However, now somebody can retrieve my password and
use it to read my e-mail somewhere else, without any risk to get caught! That is
not acceptable.

Note that it is possible to view the passwords as a default, and many users may
not even be aware of this.

Reproducible: Always
Steps to Reproduce:
1. Tools - Options - Advanced - View password - button "Show Passwords"
2.
3.

Actual Results:  
The program shows the passwords by default. 
You can use a master password, but then you have to input the password every
time thunderbird is started.

Expected Results:  
There should be an option that the master password is required for just the
viewing of the account passwords, and not fo sending/receiving mail etc.

Protection against viewing of the passwords should be on by default, or the user
should be made aware of this during installation.

Comment 1

[Eliot Landrum]

*** This bug has been marked as a duplicate of 259996 ***

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2]]

v.