308570 - when I open the form manager and choose show password

Status: RESOLVED WORKSFORME

(Toolkit :: Form Manager, defect)

Description

[Suzan Burdick]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MediaPilot; .NET CLR 1.1.4322; Crazy Browser 2.0.1)
Build Identifier: 5.0

I was just trying out the different features of Firefox and when I came to the 
form manager and tried show password I tried several pages where I didn't care 
if my password showed, but then I tried a site where my password should never 
be shown and it displayed it. 

Reproducible: Always

Steps to Reproduce:
1.choose file manager
2.scroll to show password
3.

Actual Results:  
secured password was displayed

Expected Results:  
<B>NOT HAVE SHOWN PASSWORD</B>

Comment 1

[Daniel Veditz [:dveditz]]

By "show passwords" do you mean your password was filled in on a web page form?
Or are you talking about the "View Saved Passwords" button in the Privacy
section of the Options dialog?

Comment 2

[Jesse Ruderman]

I don't understand what you mean by "I tried several pages where I didn't care 
if my password showed, but then I tried a site where my password should never 
be shown and it displayed it."  How was the last site different from the others?
Had you asked Firefox to remember all of those passwords?

Comment 3

[Suzan Burdick]

I used the button named forms where it shows a lock. I chose the words show 
passwords. the difference in the pages were say. I beling to an affiliate site 
i.e. linkshare, so password is not that critical. It showed my password. Then I 
went to my Banking site and chose show password and it showed what my password 
was and automatically filled in my ID. I do not use save password for these 
types of site. When I tried it this morning to see what would happen it 
automatically entered my ID, but not my password. I deleted my ID and tried the 
show password again and it says 0 passwords shown. When it put in my ID it said 
1 password shown. Didn't show ID or password this time. Seems that it is an 
arbitrary thing, but in any case it shoud not have even shown my ID.
Suzan

Comment 4

[Daniel Veditz [:dveditz]]

Do you have any extensions installed? Your description isn't matching the product in front of me. There is no Button named "Forms" anywhere.

On a secure site if you double-click on the lock icon in the url bar (single click in the upcoming 1.5) then you get the page info dialog. It has a "Forms" tab that will show the current data filled in forms, but any password fields are replaced with "****". There is nowhere it says anything like "X passwords shown".

On the Options dialog there is a lock icon with the label "Privacy". There is a "Saved Form Information" section that doesn't show passwords, and a "Saved Passwords" section that has a "View Saved Passwords" button. That button brings up a list of all saved user names. It doesn't matter what site you are on. There is a "Show Password" button on that dialog that will show all the passwords -- if you have a master password set then it will ask for that first. If you don't have a master password set then your passwords aren't really protected anyway. There is no place to put in an ID on that dialog (you can remove them, though), and it has no text like "0 passwords shown".

In any case this list should only save password info for sites where you have told us to save the password. When the prompt comes up you can say "No" or "Never for this site" for sites you are extra concerned about. If your PC is in any way potentially insecure (and if you're connected to the internet it is) then you should use a master password to encrypt the saved passwords.

If this is the "Show Passwords" button you're talking about then this is a duplicate of bug 259996.