385951 - It should be possible to select "don't ask again" when prompted for master password

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager, enhancement)

Description

[Magnus]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4

If master password is set, users that do not know it (guest users) are asked again and again for a master password when filling out fields for which the password manager knows the password. Instead of clicking cancel multiple times, one should be able to select "Don't ask me again in this session" or something comparable.

Note that this refers to asking for password once per password field (or once per entered character of user name for some sites), rather than once per stored password in the password manager, as reported in bug 381164.

One a user has selected "Don't ask me again in this session" or comparable, it would be convenient that an icon or toolbar appeared on the screen, alerting the user that the password manager is temporarily disabled. With the toolbar solution, the text "Password Manager knows a username/password for this site, but is temporarily disabled. Please click here to enter the master password and re-enable password manager" or comparable, could be shown in the toolbar.

Ideally, clicking this icon or toolbar would trigger a password manager prompt again.

Note that with a toolbar solution, it may even be unnecessary to add a separate button on the dialog. Simply pressing cancel could bring FireFox into an unobtrusive toolbar mode, where nothing is popped up, but only a popup-blocker style toolbar is shown on login pages.

Reproducible: Always

Steps to Reproduce:
1. Start FireFox and go to a login page with stored password
2. Select cancel when prompted for password
3. Go to another login page (or again to the same one)
3. The popup dialog will be shown again.
Actual Results:  
Popup dialog is shown again and again when going to a login page.

Expected Results:  
Popup dialog should not be shown multiple times. If user does not know the password the first time, he/she will probably not know it the second time.

Comment 1

[Justin Dolske [:Dolske]]

Confirming. This makes Firefox annoying to use for anyone who wants to share their computer with another person, even for relatively brief periods of time. While the "proper" solution is to have multiple profiles or user accounts (for, say, a computer shared by a family), I think the target use cases for this bug are the more casual "hey, can I use your computer while you're making dinner" type situations.

Comment 2

[Jesse Ruderman]

See also bug 389208, "Option to prevent password autofill by default (e.g. to keep master password dialog from popping up when I don't want to log in)".

Comment 3

[Minesh Mistry]

@Magnus,

I think that this is a fantastic idea. I was hoping that this would be introduced by FF3... but I'm running FF3 RC1 and no dice...!

I had the exact same idea as you. I noticed in FF3 b5 that when signing up for a _new_ account on a webpage, the prompt that asks you if you want FF to remember the username+password is in an (unobtrusive) 'popup blocker-style' bar at the top of the broswer. I vote for the same feature to be applied to when the password manager needs the master password in order to fill in forms.

It is extremely annoying for a pop-up window to appear especially when opening many tabs from 'social bookmarking' websites such as Digg or Slashdot (!). This would be a 'killer feature' for Firefox, in my opinion.

Comment 6

[dauge]

There is no "don't ask again" option.  The only choices are ok or cancel.

Comment 9

[Jared Wein [:jaws] (please needinfo? me)]

I'll add some steps here for how to do this.

Comment 10

[sransara]

I would like to work on this bug and it would be a great start for me to start working on mozilla codebase. And this is a feature that I also would like to be appeared in upcoming Firefox versions.

Comment 11

[Jared Wein [:jaws] (please needinfo? me)]

FYI: This is probably like a "good twentieth bug".

Comment 12

[gothu000]

Hi,
I am interested in contributing to this bug. Could you please guide me on getting started with it.
Thanks!

Comment 13

[Andres Hernandez [:andreshm]]

I'll take a look at this.

Comment 14

[Andres Hernandez [:andreshm]]

The master password prompt is opened when calling nsISecretDecoderRing::decryptString on crypto-SDR.js decrypt method. Internally, this calls PK11_Authenticate, which I think shows the prompt. So, in order to change the prompt to add a "don't ask again" checkbox, it's more a c++ change first than just js.

Comment 15

[Justin Dolske [:Dolske]]

It's generally agreed among UX/Engineering/Product that we don't want to further develop the existing master password functionality, as it's a poor fit for current needs and our current direction in this area.

Comment 20

[Matthew Davis]

:Dolske what do you mean there's no further development in this area? Do you mean there's no point doing incremental changes to this prompt because it will be overhauled soon? Or do you mean that an important security function with lots of bugs against it will be deliberately neglected forever more?

Use case:

My girlfriend keeps borrowing my laptop because hers is broken.

Solely because of this bug, and no other reason, she has vowed to never install Firefox on any of her own devices.

"It asks me for the password on every single page. It's so annoying. I've got nothing to hide. I just want to browse."

(This is exacerbated by the fact that if you type in the wrong password, it won't tell you. The popup will go away then come back later again. She kept typing in my OS login password, assuming that was the same as my browser's master password. Then the popup comes back again and again.)