367588 - MASTER PASSWORD SYSTEM WIDE SNAFU -- Set MPS others Suffer on the system

Status: RESOLVED INVALID

(Toolkit :: Password Manager, defect)

Description

[Michael Lonewolf]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1; .NET CLR 2.0.50727) Gecko/20061204 Firefox/2.0.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1; .NET CLR 2.0.50727) Gecko/20061204 Firefox/2.0.0.1

My Master Password is working Just fine, 
in the past set Master password on Administrator level account and user account works just fine FireFox wont hound me for MPS ; could set up separate mps per windows accounts etc on/off depending on users tastes


Oddly in this Fresh Install of FireFox not working so good.


Reproducible: Always

Steps to Reproduce:
1. Set MPS under user account / OR install PKI (free Email-certs etc ) 
2. Master passwords go ON and affect everybody with SAME password or Random  (all but for user whom set it)
3. Watch as USMC fresh home from Iraq who owns this PC (my Linux box still In storage) Want to kill me over it, and his girlfriend too. since my passwords are affecting them It's 

AS IT Security Professional I use PKI to Cover My Own Hide, It's pretty dang hard to send stuff as somebody else with verified PKI.  If I log into My websites it leaves a nice trace, and makes it easy to exclude me from finding break-ins.

Actual Results:  
FireFox is all Mine whoo hahah , user running as GOD huhuaha , making all else suffer. (NOT what I intended) setting up my own MPS and importing PKI email certs hushmail etc ; has kicked them out of firefox creating a local LDDoS attach

accont=me  ; other accounts Administrator ; roomates gf  Suffering 

sometimes my MPS works on thiers other times IT dose not. passwords are known or RANDOM 

As A secrity Anylyst I have red up on reseting  the master even trying to shut it off.

To NO AVAIL. Once YE set Master Passwords ; you cant even dissable them after loging in. it seams I seam to be able to remove mine but...... not sure it would remedy the issue.

Expected Results:  
Older FireFox results ; Each Widowze account has there own way on FireFox
MPS on/off  password@users preferences if. PKI installs peruser just like a linux account 

Generated: Sat Jan 20 2007 10:48:52 GMT-0500 (Eastern Standard Time)
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1; .NET CLR 2.0.50727) Gecko/20061204 Firefox/2.0.0.1
Build ID: 2006120418

Enabled Extensions: [55]

    * Atomic 0.6 - {57880424-6346-4fff-9718-97a88ea6d0e3} - An Atom protocol client for creating and manipulating Atom feeds.
    * BBComposer 0.5.2 - [e-mail] - Permet l'édition de BBCode, XBBCode, XHTML et Wiki en WYSIWYG.
    * Calculator 1.1.5 - {AA052FD6-366A-4771-A591-0D8DC551585D} - A calculator with advanced features. Installed in the tools menu.
    * ChatZilla 0.9.77 - {59c81df5-4b7a-477b-912d-4e0fdf64e5f2} - A clean, easy to use and highly extensible Internet Relay Chat (IRC) client.
    * CHM Reader 0.2.1.1 - {6e098d65-7d2d-46d4-ada0-2f882a29f795} - An extension make firefox support CHM file reading.
    * Clippings 2.5 - {91aa5abe-9de4-4347-b7b5-322c38dd9271} - Save frequently-entered text for pasting later.
    * Codetch 0.4.0.20061026 - {420ed894-c19f-4318-a83f-bacae374db28} - A code editing application.
    * Deepest Sender 0.7.9 - {B9DAB69C-460E-4085-AE6C-F95B0D858581} - Post to blogs directly from SeaMonkey/Firefox.
    * DOM Inspector 1.8.1.1 - [e-mail] - Inspects the structure and properties of a window and its contents.
    * Download Embedded 0.5 - [e-mail] - Downloads all embedded objects on a webpage.
    * DownThemAll! 0.9.9.7 - {DDC359D1-844A-42a7-9AA1-88A850A938A8} - The mass downloader for Firefox.
    * Exif Viewer 1.10 - [e-mail] - Extracts and displays the Exchangeable Image File (Exif) data, as stored by digital still cameras, in both local and remote JPEG images.
    * Fasterfox 2.0.0 - {c36177c0-224a-11da-8cd6-0800200c9a66} - Performance and network tweaks for Firefox.
    * FFClickOnce 0.4.1 - [e-mail] - Allows Firefox to run a .NET ClickOnce application.
    * FireFTP 0.94.6 - {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - FTP Client for Mozilla Firefox.
    * FireMule 0.4.1 - {D644F7E7-5141-4fac-A59C-21101C82C734} - Allow add multiple downloads to eMule/eDonkey2000.
    * FoxyTunes 2.2 - {463F6CA5-EE3C-4be1-B7E6-7FEE11953374} - Control any media player from Firefox and more...
    * Gmail Space 0.5.3 - {B9C8BE50-7105-4ec6-8FB4-4935C0671648} - Use your gmail account space for file storage. Enables to upload/download folders.
    * Google Toolbar for Firefox 2.1.20060807W - {3112ca9c-de6d-4884-a869-9855de68056c} - Take the power of Google with you anywhere on the Web!
    * HostIP.info Geolocation Plugin 0.4.1 - {49eba0b5-0393-4e13-8cc4-06298a281c5d} - Displays Geolocation information for a website using hostip.info data.
    * IE Tab 1.3.0.20070110 - {77b819fa-95ad-4f2c-ac7c-486b356188a9} - Enables you to use the embedded IE engine within Mozilla/Firefox.
    * Image Zoom 0.2.7 - {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68} - Adds zoom functionality for images
    * infoRSS 1.1.2 - {f65bf62a-5ffc-4317-9612-38907a779583} - Display RSS and Atom headlines in the Firefox status bar.
    * LiveJournal Hook 2.1.3 - {D469DA71-A9C6-48f1-B86E-67313AADB588} - LiveJournal options and features in a right-click menu.
    * Menu Mod 1.0 - {8b68fd37-ac54-4c6c-a165-e369ce5ea38e} - Adds many options to modify the firfox menus.
    * MR Tech Link Wrapper 2.1 - {AE7FD9A4-892A-4DE0-B635-4C58D0B0E09F} - Wraps long links to spare you from having to scroll left and right. (en-US)
    * MR Tech Local Install 5.3.2.3 - {9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC} - Local Install power tools for all users. (en-US)
    * MySpace PFF Addon 0.3 - [e-mail] - A MySpace mode for pff for myspace blogging
    * MyWiki Toolbar 1.0.2.28 - {e22e8d11-0f3e-4d46-8fc1-7264b4d5ea01} - More than just a toolbar.
    * NewsFox 0.6.2 - {899DF1F8-2F43-4394-8315-37F6744E6319} - RSS/Atom News Reader.
    * OpenOffice.org Menu 1.0.2 - {777181b2-bbac-4e6b-9c3f-499d17029514} - Additional navigation menu for OpenOffice.org via main-menu and context menu.
    * PasteIP 1.7 - {998911E3-4D6E-4497-9554-B5655E9CC7FD} - Allows you to paste your IP address or User-Agent string into a textbox or message window.
    * PDF Download 0.7.8 - {37E4D8EA-8BDA-4831-8EA1-89053939A250} - Allows to choose what you want to do with a PDF file: download it, view it with an external viewer or view it as HTML!
    * Personal Menu 2.3 - [e-mail] - Replace the conservative menus, beautify your Firefox!
    * RadioMan Toolbar 1.0.1.29 - {ca1275f1-01e3-4750-a72d-77e7ad3b8e93} - Listen to thounsands of internet radio stations around the World as you browse with Firfox!
    * RSS Editor 0.0.9.3 - {dc0be2dc-0bbf-a9aa-3e87-d04293eb7353} - Gecko based desktop RSS editor
    * rssplaypen 1.0.31.20061220 - [e-mail] - rss feed extension
    * Save Image in Folder 1.1.1 - {5e594888-3e8e-47da-b2c6-b0b545112f84} - Easily save images in personally customized folders.
    * Save Link in Folder 1.3.1 - {7a46f9fe-4818-4837-ae4a-39c53978ae99} - Easily save links in personally customized folders.
    * SpiderZilla 1.6.0 - {3cd27e92-1a30-11da-94c6-00e08161165f} - Spiderzilla is an easy-to-use website mirror utility , based on Httrack from www.httrack.com.
    * Sun Cult 1.0.20061106 - [e-mail] - Worldwide Sunrise, Sunset, Twilight, Moonrise and Moonset Times
    * Svensk ordlista 1.4 - [e-mail]
    * Talkback 2.0.0.1 - [e-mail] - Sends information about program crashes to Mozilla.
    * Thumbs 0.6.3 - {6cffc2d6-aea4-4032-b8c6-d211fe6ded4e} - Shows the first thumbnail from each linked gallery.
    * Torrent-Search Toolbar 1.0.1.30 - {e0c7b854-d5ce-4db6-9804-be1438603d89} - More than just a toolbar.
    * Track Package 1.6 - {3f669128-5ad3-4053-ad9b-1afc4ea24c28} - Track Packages from the right-click menu.
    * Unofficial Myspace Toolbar 1.3.2 - [e-mail] - Automatically login, view hidden comments, and more!
    * UnPlug 1.5.4 - unplug@compunach - UnPlug your Plug-ins, free your Media
    * Update Notifier 0.1.5.2 - {95f24680-9e31-11da-a746-0800200c9a66} - Notifies you when updates are available for your extensions and themes.
    * Uploadr for Flickr 1.0 - [e-mail] - Upload images to flickr
    * VideoDownloader 1.1.1 - [e-mail] - Download videos from Youtube, Google, Metacafe, iFilm, Dailymotion... and other 60+ video sites ! And all embedded objects on a webpage (movies, mp3s, flash, quicktime, etc).
    * Wizz RSS News Reader 2.1.6 - {D5EDC062-A372-4936-B782-BD611DD18D86} - A fairly good RSS and Atom news reader.
    * XHTML Mobile Profile 0.3.6 - {8ea9957e-2953-402f-80e0-bceb5f169d6f} - Allows XHTML Mobile Profile to be displayed in the browser.
    * XMPP4Moz 0.4.0.2007011622 - [e-mail] - XMPP integration layer for Mozilla
    * Yahoo! Toolbar 1.3.0.20060829 - {635abd67-4fe9-1b23-4f01-e679fa7484c1} - Get more out of Yahoo! and the web!


Disabled Extensions: [3]

    * Conversation Meta Language 0.7.3 - [e-mail] - Email Conversation with XML
    * Enigmail 0.94.1.1 - {847b3a00-7ab1-11d4-8f02-006008948af5} - OpenPGP message encryption and authentication
    * Launchy 4.2.0 - [e-mail] - Open links and mailto's with external applications like Internet Explorer, Netscape, Opera, Outlook etc


Total Extensions: 58

Installed Themes: [2]

    * Firefox (default) - {972ce4c6-7e08-4474-a285-3208198ce6fd}
    * GNOME Firefox Theme 0.2.3 - {b4db8648-cfbc-2051-c13b-3da9974f2eed} - GNOME Firefox Skin for Windows


Installed Plugins: (33)

    * Adobe Acrobat: nppdf32.dll
      - Adobe Acrobat Plug-In Version 7.00 for Netscape
    * Internet Pictures Corp. iPIX Plugin v6.2: NpIpx32.dll
      - Netscape Plugin iPIX Viewer
    * Java(TM) 2 Platform Standard Edition 5.0 Update 10: NPJava11.dll
      - Java Plug-in 1.5.0_10 for Netscape Navigator (DLL Helper)
    * Java(TM) 2 Platform Standard Edition 5.0 Update 10: NPJava12.dll
      - Java Plug-in 1.5.0_10 for Netscape Navigator (DLL Helper)
    * Java(TM) 2 Platform Standard Edition 5.0 Update 10: NPJava32.dll
      - Java Plug-in 1.5.0_10 for Netscape Navigator (DLL Helper)
    * Java(TM) 2 Platform Standard Edition 5.0 Update 10: NPJava13.dll
      - Java Plug-in 1.5.0_10 for Netscape Navigator (DLL Helper)
    * Java(TM) 2 Platform Standard Edition 5.0 Update 10: NPOJI610.dll
      - Java Plug-in 1.5.0_10 for Netscape Navigator (DLL Helper)
    * Java(TM) 2 Platform Standard Edition 5.0 Update 10: NPJPI150_10.dll
      - Java Plug-in 1.5.0_10 for Netscape Navigator (DLL Helper)
    * Java(TM) 2 Platform Standard Edition 5.0 Update 10: NPJava14.dll
      - Java Plug-in 1.5.0_10 for Netscape Navigator (DLL Helper)
    * MeadCo's Neptune: npmeadax.dll
      - MeadCo's Neptune
    * Microsoft Corp. DRM Netscape Plugin: npwmsdrm.dll
      - DRM Netscape Plugin
    * Microsoft® DRM: npwmsdrm.dll
      - DRM Store Netscape Plugin
    * Mozilla ActiveX control and plugin support: npmozax.dll
      - Mozilla ActiveX control and plugin module
    * Mozilla Default Plug-in: npnul32.dll
      - Default Plug-in
    * OpenOffice.org Plug-in: npsoplugin.dll
      - OpenOffice.org Plug-in handles all its documents
    * PCMan's IE Tab Plug-in for Mozilla/Firefox: npietab.dll
      - IE Tab Plug-in developed by Hong Jen Yee
    * QuickTime Plug-in 7.1.3: npqtplugin3.dll
      - The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
    * QuickTime Plug-in 7.1.3: npqtplugin7.dll
      - The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
    * QuickTime Plug-in 7.1.3: npqtplugin4.dll
      - The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
    * QuickTime Plug-in 7.1.3: npqtplugin5.dll
      - The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
    * QuickTime Plug-in 7.1.3: npqtplugin.dll
      - The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
    * QuickTime Plug-in 7.1.3: npqtplugin6.dll
      - The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
    * QuickTime Plug-in 7.1.3: npqtplugin2.dll
      - The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
    * RealJukebox NS Plugin: nprjplug.dll
      - RealJukebox Netscape Plugin
    * RealNetworks Rhapsody Player Engine: nprhapengine.dll
      - Rhapsody Player Engine Plugin
    * RealPlayer Version Plugin: nprpjplug.dll
      - 6.0.12.1483
    * RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) : nppl3260.dll
      - RealPlayer(tm) LiveConnect-Enabled Plug-In
    * Shockwave Flash: NPSWF32.dll
      - Shockwave Flash 9.0 r28
    * Shockwave for Director: np32dsw.dll
      - Adobe Shockwave for Director Netscape plug-in, version 10.1
    * Windows Genuine Advantage: npLegitCheckPlugin.dll
      - 1.5.0723.1
    * Windows Media Player Plug-in Dynamic Link Library: npdsplay.dll
      - Npdsplay dll
    * Yahoo Application State Plugin: npYState.dll
      - Yahoo Application State Plugin
    * Yahoo! activeX Plug-in Bridge: npyaxmpb.dll
      - Yahoo! activeX Plug-in Bridge

Comment 1

[Daniel Veditz [:dveditz]]

If the three of you are using separate windows accounts you should automatically be getting separate Firefox profiles that should not be affecting each other. If you're trying to share a single windows account you could still set up separate Firefox profiles and then turn on the initial profile selection UI (not the default).

If you've done that it's possible that plugins or addons in that amazing collection of yours are conflicting with each other. This could be tested by running in "safe mode" to disable all the addons.

A bug report is probably not the right way to go in this instance. People coming by (like myself) are going to look at this and say "I don't know what's going on" and move on to another bug where it's clearer what needs to be done. Given limited programming time it's more bugfixing bang for the effort. You really ought to work interactively with community support experimenting with different things to try to clarify the issue.

http://www.mozilla.org/support/#community

Comment 2

[Justin Dolske [:Dolske]]

I'm having a hard time parsing comment #0, but as far as I can tell the problem is what suggested in the last comment. Namely, that somehow the reporter's set up has multiple users sharing a common Firefox profile.

The master password is specific to the key3.db file in a FF profile, and the logins saved in signons2.txt are encrypted with the key in key3.db. Sharing a profile or copying these files between profiles is the only way I can think of that this kind of thing could possibly happen.

If you're still having this problem, please provide a succinct summary of how to reproduce this with new, clean Firefox profiles, and what the filesystem paths to those profiles are.