266945 - Add confirm prompt for "Remove All" operation in Password Manager

Status: RESOLVED FIXED

(Toolkit :: Password Manager, enhancement, P2)

Description

[Petey]

Considering the proximity of the "Remove All" button to the "Remove" button in
the Password Manager, it would be a reasonable precaution to add a confirm
prompt when clicking "Remove All."  This coming from a user who just deleted all
of his saved passwords.

Comment 1

[Daniele Dellafiore]

I add that it would be real good that firefox ask for master password when
Remove All button is pressed. 

Comment 2

[Mugros]

I wanted to file this enhancement (it's not a bug) also. Maybe the owner or
someone else could change it to "enhancement".
I accidentally clicked on the "remove all" button while sorting some passwords
out. Luckily i had a backup.

Comment 3

[[e-mail]]

(In reply to comment #1)
> I add that it would be real good that firefox ask for master password when
> Remove All button is pressed. 

The master password is asked (if there is one) before even displaying this
dialog . A confirmation should be sufficient, no matter whether there is a
master password or not. 

Comment 4

[Rahul Kothari]

(In reply to comment #3)
> (In reply to comment #1)
> > I add that it would be real good that firefox ask for master password when
> > Remove All button is pressed. 
> 
> The master password is asked (if there is one) before even displaying this
> dialog . A confirmation should be sufficient, no matter whether there is a
> master password or not. 


No, master password Should be asked again as the person may be surfing from
(say) 3 hours and s/he may have entered the master password before 3 hours. Now,
if s/he gets up from her place to have water or alternatively pee (hehe), then
someone can access his PC and easily clear all passwords. Hence, the need for a
second confirmation while clearing passwords, IMHO.

Comment 5

[Dave Townsend [:mossop]]

*** Bug 313891 has been marked as a duplicate of this bug. ***

Comment 6

[zug_treno]

*** Bug 318468 has been marked as a duplicate of this bug. ***

Comment 7

[Alan Mills]

I couldn't find this discussion & started a new one of same relavence. # 321720.
There must be safeguards against deleting all, whether accidental or deliberate.  If a confirmation must be made, the person will almost always click yes.  This should be password protected.

All of my bookmarks, preferences, and passwords were deleted.  Even the Firefox colors, and toolbars were put back to default.

System Restore will put things back.

Comment 8

[Reiner Keller]

Hi,

i recommand the confirmation method with reuired ok without master password and with master password if one is set. Rahul explained good why it has to be.
;-)
Reiner
without any password yet ... even norton protected trash couldn#t help to restore the accidently clicked "remove all" (what is good in security sight)...

Comment 9

[Mike Sprinkle]

I have accidentally deleted my passwords twice now.  The second time, I didn't even click on the "Remove All" button; I had two computers in front of me and I accidentally typed the letter "A" on the wrong keyboard.  That's right, if the passwords are shown, SIMPLY PRESSING "A" DELETES YOUR PASSWORDS.

Comment 10

[[e-mail]]

Changed to enhancement though this is a severe usability bug. It is just too easy to delete one hundred stored passwords here. This bug has an extremely high potential to piss off users who accidentally hit the wrong button. 

Comment 11

[Mike Connor [:mconnor]]

Gah.  This is pretty bad for something we can't undo!

Comment 12

[Mike Beltzner [:beltzner, not reading bugmail]]

Chris Ilias recently made a public call for its removal on his blog (http://ilias.ca/blog/2006/04/removing-remove-all.html). A couple of things to consider as well:

 - consistency for controls to clear the various bits of user data we store is horrible; some have "View" and "Clear" controls in the pref panel, others have "Clear All" commands in the modal dialogs launched by the "View".

 - the Clear Private Data function is yet another place where people can clear their saved data

 - the Cookies Manager also has a "Remove All" button right next to "Remove" which also removes all cookies without a confirmation

What I'd suggest:

 - add a confirmation dialog for the "Remove All" buttons
 - remove the "Clear x" buttons in the pref panels
 - consolidate/synchronize the "Clear Private Data" functions (see bug 302620) so that there's a set of settings and then a function; this probably should have its own pref-panel tab 

Comment 13

[Simon Bünzli]

(In reply to comment #12)
>  - add a confirmation dialog for the "Remove All" buttons
Is this option needed at all?

If you want to remove all cookies/passwords/blocked image domains/etc. you can always select all entries through click, scroll, shift+click and then hit remove. And for people who don't know about this, the Clear Private Data... dialog is probably rather the way to get rid of their private data anyway.

Out of curiosity: when would somebody want to get rid only of all cookies (or passwords, etc.)?

Comment 14

[Cameron]

(In reply to comment #13)
> Out of curiosity: when would somebody want to get rid only of all cookies (or
> passwords, etc.)?

When they have something to hide ;)

Comment 15

[Simon Bünzli]

(In reply to comment #14)
> (In reply to comment #13)
> > Out of curiosity: when would somebody want to get rid only of all cookies (or
> > passwords, etc.)?
> When they have something to hide ;)

When I've got something to hide, I'd rather use Clear Private Data... in the first place.

Just to get the question correct: why would somebody want to get rid of all cookies (but /not/ also the browser history, cache, form data and authenticated sessions) - but unconditionally of all cookies (and not just of the ones belonging to "some" sites)? Would that answer vary when replacing "cookies" with "passwords"/"domains with blocked images"/etc.?

Comment 16

[Bryan]

(In reply to comment #13)
> (In reply to comment #12)
> >  - add a confirmation dialog for the "Remove All" buttons
> Is this option needed at all?

Of course it is and should have been there long ago.  Think about those times when you've accidentily clicked on something.  There are many reasons why a user would be looking at their cookies and could easily click remove all on accident.  It's better to be safe then sorry!

~B

Comment 17

[aveclafaux]

I thought confirmation dialog were bad UI (tm), as people have a tendency to click YES (OK I know in Firefox usually it is better than a YES/NO choice), because in the first place they did not notice that tney clicked on the wrong button, thus don't expect to have to take care...

I feel removing the 'remove all' is completely valid as multi-selection is possible in the window and multi-selection is a very common feature these days - but multi-selection can not be accidently triggered, thus is probably way better than a confirmation dialog... Actually the same logic works for the 'Remove' button: as we need to select first there is noneed for a confirmation dialog.

If people are afraid of the poor discoverability of the fetaure, I suggest adding a 'Use Shift+Select to select multiple entry at a time' sentence below the scrolling pane (I know the exact multi-selection procedure need to be adressed per platform, but you get the idea).

If people find it is really too complicated, we (well, rethoretically speaking :-) could implement the Ctrl+A (select all) in the scrolling pane.

Comment 18

[Mike Beltzner [:beltzner, not reading bugmail]]

(In reply to comment #17)
> I thought confirmation dialog were bad UI (tm), as people have a tendency to
> click YES (OK I know in Firefox usually it is better than a YES/NO choice),

Excessive confirmation dialogs are bad, as are confirmation dialogs in common taskflows where the user is likely to see them over and over again leading to a learned response of "clickthrough". In cases like these, however, where they can prevent accidental dataloss for uncommon tasks like managing passwords, they're just plain sensible.

> I feel removing the 'remove all' is completely valid as multi-selection is
> possible in the window and multi-selection is a very common feature these days

Multi-selection is commonly supported, but I don't think it's commonly used. Those who know about it cherish it and thrive, but are few in number and therefore it should not be the only supported mechanism for success.

> If people find it is really too complicated, we (well, rethoretically speaking
> :-) could implement the Ctrl+A (select all) in the scrolling pane.

See above, as it applies here as well.

"Remove All" is a convienience function in a manager like this, but an important one to support the following task flow:

 - user enters preferences
 - user sees that we store passwords
 - I wonder what passwords I've got stored?, wonders the user
 - On noes! Lookit all the passwords, exclaims the user
 - Get rid of them all!, cries the user

Comment 19

[Dão Gottwald [:dao]]

(In reply to comment #17)
> I thought confirmation dialog were bad UI (tm), as people have a tendency to
> click YES (OK I know in Firefox usually it is better than a YES/NO choice),
> because in the first place they did not notice that tney clicked on the wrong
> button, thus don't expect to have to take care...

If set, the master password could be requested.

(In reply to comment #18)
> Multi-selection is commonly supported, but I don't think it's commonly used.

So a "Select All" button would do the job, right?

Comment 20

[Mike Connor [:mconnor]]

I'm not convinced, at all, that there's a win to be found by having Select All->Remove without confirmation vs. Remove All + confirmation.  It doesn't make the task easier, and its not the obvious way to achieve the task of removing all items.

Comment 21

[Dão Gottwald [:dao]]

I'm not convinced either. :)
It was just another idea to avoid a confirmation dialog, "because in the first place they did not notice that tney clicked on the wrong button, thus don't expect to have to take care".

How about disabling the confirm button for some seconds as is the case with the extension installer?

Comment 22

[Aiing]

For consistency any confirmation dialog should apply to both the Remove All button in the "Passwords Saved" tab and the "Passwords Never Saved" tab.

A Select All makes it much less obvious to the user what the button is for. The removal all button is fine as it is but really does require a confirmation for somethings so destructive. Strange that Show Passwords which is in no way destructive requires confirmation but remove all passwords does not. 

Comment 23

[u81239]

(In reply to comment #17)
> I thought confirmation dialog were bad UI (tm), as people have a tendency to
> click YES (OK I know in Firefox usually it is better than a YES/NO choice),
> because in the first place they did not notice that tney clicked on the wrong
> button, thus don't expect to have to take care...

I think usually users notice that they clicked wrongly immediately after they clicked, but at that time are too late to prevent their click. So I don’t think there’s need for trickery like making the confirm button disabled for a few seconds, the confirm dialog in itself should be enough.

It’s like when I accidentally middle-click on my bookmarks toolbar instead of a tab; I already realise my fatal mistake while I’m clicking, and not after seeing everything in my browser window change.

I also often click on a button or a link, while clicking realise that I mis-clicked, and what I do then is hold the mouse button and move away from the focus area before releasing, as this negates the click.

It’s surprising how often these things happen to me, I can all too well imagine me making this mistake. And I don’t even have bad motor skills at all :). So I’m definitely in favour of fixing this bug.


~Grauw

Comment 24

[Mike Connor [:mconnor]]

Looks like this missed the a2 boat, Mano, if you wont' get to this for b1, please reassign to nobody@m.o so we can retriage.

Comment 25

[Asaf Romano (gone)]

Mike and Mike: Is this bug now on comment 12, or is it still in the scope of adding the confirmation dialog itself?

Also: Do we need this dialog for the Password Manager second tab?

Comment 26

[Mike Beltzner [:beltzner, not reading bugmail]]

Let's just keep it as adding the confirmation dialogs (yes, for both tabs) for now. The other ideas in comment 12 warrant their own bugs.

Comment 27

[ed50000]

I would like to have a confirm dialogue for "delete all passwords" .. I would like an option to remove or toggle the button for "delete all passwords" .. I would also like to move the remove/remove all passwords buttons to where the "view passwords" button is so that one has to move the mouse to remove all passwords.. I have been very careful up to today (this is my 3rd day with version 1.5x of firefox and this format of preferences is new to me:  tabs on top) but today I managed to delete all passwords with no recourse all in one second.. and when I clicked cancel on the preferences box, not even that brought them back.. I feel betrayed.. wish I had kept the old one that hung all the time..

Comment 28

[Asaf Romano (gone)]

Attachment: patch

Now that the Exceptions tab has been moved to a separate window, I guess this is only desired in the Remember Passwords UI.

Comment 29

[Asaf Romano (gone)]

1.8 branch:
mozilla/toolkit/components/passwordmgr/resources/content/passwordManager.js 1.11.4.2
mozilla/toolkit/locales/en-US/chrome/passwordmgr 1.4.2.4

trunk:
mozilla/toolkit/components/passwordmgr/resources/content/passwordManager.js 1.13
mozilla/toolkit/locales/en-US/chrome/passwordmgr/passwordmgr.properties 1.8

Comment 30

[Kevin Brosnan]

*** Bug 348561 has been marked as a duplicate of this bug. ***

Comment 31

[Serge Gautherie (:sgautherie)]

Attachment: (Bv1) enhanced [Copied to bug 349438]

Port/Copy of SeaMonkey enhancements from bug 337475:
*Add explicit dialog title.
*Default focus to the 'No' button.

Successfully tested with
[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6] (release) (W98SE)

Comment 32

[Asaf Romano (gone)]

Comment on attachment 234677 [details] [diff] [review]
(Bv1) enhanced
[Copied to bug 349438]

Separate bug, please.

Comment 33

[Serge Gautherie (:sgautherie)]

I filed bug 349438 then.