385462 - "web and e-mail passwords" wrongly assumes we are a browser+mail suite

Status: RESOLVED WONTFIX

(Core Graveyard :: Security: UI, defect)

Description

[Robert Kaiser]

When talking about the master password, security UI explains it protects "web and e-mail passwords", which wrongly assumes that the application even saves both of those, while this is only true for the SeaMonkey suite. Other apps like Firefox and Thunderbird only save one of those, others might not save any of those (but, says, IRC passwords, feed reader passwords or whatever).

We should probably use just "passwords" in those parts of the UI.

Comment 1

[Kai Engert (:KaiE:)]

I suspect this string is only being used in SeaMoneky, while the other applications use their own strings.


mozilla/toolkit/locales/en-US/chrome/mozapps/preferences/changemp.dtd:<!ENTITY masterPasswordDescription.label   "A Master Password is used to protect sensitive information like site passwords.  If you create a Master Password you will be asked to enter it once per session when &brandShortName; retrieves saved information protected by the password.">
mozilla/toolkit/locales/en-US/chrome/mozapps/preferences/changemp.dtd:<!ENTITY masterPasswordWarning.label       "Please make sure you remember the Master Password you have set.  If you forget your Master Password, you will be unable to access any of the information protected by it.">

Comment 2

[Robert Kaiser]

(In reply to comment #1)
> I suspect this string is only being used in SeaMoneky, while the other
> applications use their own strings.

OK, that's probably true for the pref-masterpass.dtd strings, which are safe in this case.
What about the other two results listed in the URL of this bug though, pippki.properties:142 (pw_empty_warning) and pippki.dtd:50 (resetPassword.text) - are those suite-only as well?

Comment 3

[Kai Engert (:KaiE:)]

Even if we're running Firefox, the user might have saved webmail passwords.

Even if we're running Thunderbird, the user might have loaded remote content of a web page, or passwords for some remote storage related to an add-on?

So, one could argue, the wording is not completely wrong.