399730 - remove "show passwords" button in saved login info dialog and simply show passwords because that's what's expected

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager, defect)

Description

[Asa Dotzler [:asa]]

If you go to the Security pref panel and click the "show passwords..." button, what you're actually asking to do here is to show your saved login information. That's bug 382447.  But after showing the login information dialog, there's no good reason to have a "show passwords" button again. The dialog should simply show the password column by default. 

If users want to protect their password store with a master password, then require this at the "show saved login information" button in the security preferences panel (it's not just the passwords users want to keep quiet, it's the saved and never saved logins.) and for users that don't want to protect their passwords with a master password, there's no good reason to require this extra and redundant button. 

Not only is the button silly, it's even worse because upon clicking the second "show passwords" button, I'm prompted with a are you sure dialog. WTF?

Comment 1

[Jeff Hendy]

Absolutely not!  The password manager is already enough of a social engineering risk, it should not be made any easier for users to accidentally show their passwords to onlookers.

Comment 2

[Justin Dolske [:Dolske]]

Some of this was discussed in bug 259996...

The general problem is that we want to avoid the surprise of suddenly having all you passwords shown on screen. Maybe a user should expect that after clicking the initial "Show Passwords" button, maybe not.

Perhaps the UI could be tweaked a bit, by replacing "No, Really, Please Show The Passwords" button with a checkbox whose value persists...

[ ] Show password values

Off by default, state persists, dynamically toggles the displayed values between "********" and "mYsEcReT". Once someone discovers the dialog here (and that it shows real passwords!), they can use the checkbox to keep things in the state they want.

This is perilously close to the dreaded "add a pref", but otoh it's a compromise between to two legitimate constraints (avoid surprise passwords, don't annoy users).

Comment 3

[Justin Dolske [:Dolske]]

Bug 382447 tweaked the wording here to be a bit better. I think the current state of things (the extra "no, really, show the passwords") button isn't perfect, but is already a reasonable compromise between the two use cases.