269694 - access to passwords possible without master password

Status: RESOLVED DUPLICATE of bug 259648

(Toolkit :: Password Manager, defect)

Description

[Dave Yorke]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

Password manager is on and master password is blank by default.  This allows
guest users to view and remove passwords.  The password manager shouldn't work
without a warning or having the user set a master password.

Also, if there are already passwords saved, turning on the master password
should require that you confirm a random password in the list.  This way a guest
can't switch on the master password to lock the owner out of password manager.

Reproducible: Always
Steps to Reproduce:
1. Tools --> Options...
2. Privacy --> Saved Passwords --> View Saved Passwords...
3. Show Passwords

Actual Results:  
It showed me all passwords.

Expected Results:  
Told me that master password isn't set, and to go to hell.

I can't believe this is possible.  Even internet exploder doesn't allow me to
view my passwords.

Comment 1

[Reuben Chew]

I find this annoying as well. I don't set a master password because I find it
annoying having to enter a password. The point of the password manager is to do
away with entering passwords.

This problem also occurs on Mozilla Thunderbird. I feel that passwords should be
encrypted instead of being shown easily.

I'll switch back to IE until this is fixed.

Comment 2

[Reuben Chew]

I feel that Firefox should also take a leaf from Mozilla Thunderbird and have
the ability to reset master passwords.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

*** This bug has been marked as a duplicate of 259648 ***