362091 - ebay Login brings up extra login names from users not connected to this computer

Status: RESOLVED INCOMPLETE

(Firefox :: Security, defect)

Description

[Eric Buczynski]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

I'm using a Mac G4 with OS 10.4.8 and Firefox as my only browser, and I noticed a login problem that hackers might try to exploit.  I only have my screenname saved on here, so when I login, it comes up automatically.  However, sometimes the login page takes a while to load all the code and graphics.  During this time I've clicked multiple times on the login field, and I'll see other ebay user ids come up from time to time in alphabetical order.  A few times this list consisted of my mom's and sister's screennames, but they rarely use my computer, and when they did it was months ago when their PC was out on repair.  More often than not it's screennames of other ebay members though, and looking through carefully it looks like they're ebay ids of people I've sold to before using a work screenname.  If someone else uses the same computer, that person may try to exploit the other screenname and try to get their password now that they have a valid user id and not a random one.

Reproducible: Sometimes

Steps to Reproduce:
1.go to ebay
2.if there's a delay in getting graphics and text up but the login field appears, try clicking on the field multiple times
3. the password won't appear if you select a different screenname than that of your own (if your own password is saved)

Actual Results:  
The password won't appear if you select a different screenname than that of your own (if your own password is saved)


As long as the login page loads quickly, there's no chance of bringing up extra ebay user ids

Comment 1

[Daniel Veditz [:dveditz]]

My best guess is that if the page hasn't fully loaded (which trigger the password manager) then you're getting normal "form fill" behavior, and that will show data from other fields with the same name.

If you want to get rid of this data look on the "Tools" menu for the "Clear Private Data" item, where it's the "saved form and search history" checkbox. In the options dialog you can have this data cleared every time you shut down automatically if you wish, or turn off collection of this entirely (on the "Privacy" tab).

I think this is "as designed".

Comment 2

[u279076]

Resolving unconfirmed bugs older than a year with no activity as INCOMPLETE.  Please reopen or file a new bug if you can still reproduce the bug.