432020 - Display Requesting Domain or Account in Master Password Popup

Status: NEW

(Toolkit :: Password Manager, enhancement, P5)

Description

[David E. Ross]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080313 SeaMonkey/1.1.9
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080313 SeaMonkey/1.1.9

When the Password Manager "Password Required" popup requests input of the master password, the domain requesting a user ID and password might be different from the domain of the page requested by the user.  The name of the actual domain requesting a user ID and password should be displayed in the popup.  

Reproducible: Always




I went to the cited URI and requested "Get Directions".  I then input the start address and end address of a trip.  The "Password Required" popup appeared.  

Although that site used to require a user ID and password, I don't think they are required any more.  I deleted the entry for that site quite some time ago.  I cannot determine which entry in my password database would apply to that site.  Having the domain that is requesting an ID and password would help me to resolve this.  Having this feature implemented would help users resolve similar situations in the future.  

It appears that the Password Manager is treating the starting address as a user ID and the ending address as a password.  If no entry existed in my password database for the requester, however, I would have seen the popup that asks whether I want to save, not to save, or never to save the user ID and password.  I did not see this.

Comment 1

[David E. Ross]

This is a special problem when using tabs.  I often get a request for a password for a Web page on a tab other than the tab I am currently viewing.  This generally happens with slow servers.  When this happens, I am not sure which tab needs a password.  I might want to cancel rather than supply the master password.

Comment 2

[David E. Ross]

SeaMonkey now uses the Password Manager Toolkit.

Comment 3

[David E. Ross]

For mail/news products (e.g., Thunderbird, SeaMonkey), "domain" should be the server.  

In the mozilla.support.thunderbird newsgroup, a user reported that a particular newsgroup (apparently not on news.mozilla.org) needs a user ID and password.  If possible, implementation of this RFE for that case should include the names of both the newsgroup and its server.  Of course, when the request is only for the server itself and not for any particular newsgroup, implementation would display only the name of the server.  

See <news://news.mozilla.org:119/[e-mail]> and its subsequent thread.

Comment 4

[David E. Ross]

This is also a problem in Thunderbird where the user might not know which account is requesting a login.  In that case, the account name should be displayed instead of the domain.

Comment 7

[Albert Scheiner [:alberts]]

Attachment: thunderbird-mp-prompt-macos.png

On macOS the prompt comes up on top of the current window - which might not even be related to the application. For example, when starting Firefox and Thunderbird, TB's prompt might be a slower, Firefox is open already and the prompt appearing on top of the Firefox window is actually from TB. Only when focusing the prompt, the app it belongs to gets focus and the user can see which app requested it.

Both strings - "Password Required" and "Please enter the master password for the Software Security Device" - should be changed to something less ambiguous.
Adding the product name to the first string could already help to easier identifying the app requesting the pw: "Password Required (Firefox|Developer Edition|Nightly|Thunderbird|Seamonkey|...)"

As mentioned before, the tab requiring the password would be a great information, though in TB's case it would be the email/chat/calendar account instead.

Comment 8

[Albert Scheiner [:alberts]]

Blocks (In reply to Albert Scheiner [:alberts] from comment #7)
> Adding the product name to the first string could already help to easier
> identifying the app requesting the pw: "Password Required (Firefox|Developer
> Edition|Nightly|Thunderbird|Seamonkey|...)"

Seems to be covered by bug 992569 and bug 674483

> As mentioned before, the tab requiring the password would be a great
> information, though in TB's case it would be the email/chat/calendar account
> instead.

Does this bug relate to or block bug 306730?

Comment 9

[Matthew N. [:MattN]]

(In reply to Albert Scheiner [:alberts] from comment #8)
> Blocks (In reply to Albert Scheiner [:alberts] from comment #7)
> > Adding the product name to the first string could already help to easier
> > identifying the app requesting the pw: "Password Required (Firefox|Developer
> > Edition|Nightly|Thunderbird|Seamonkey|...)"
> 
> Seems to be covered by bug 992569 and bug 674483

Those two combined with bug 1149500 would remove this problem so I'm tempted to wontfix. Rather than showing an origin (since there can be many requesting the MP at once), I would rather we only have one request at a time and it's associated with the selected tab and window. I guess there may be some complication when there are multiple windows open but we can only show the prompt when the tab and window is focused (like we do for doorhangers).