Closed Bug 437635 Opened 12 years ago Closed 11 years ago

Master password always must be entered 3 times

Categories

(Thunderbird :: Security, defect)

defect
Not set

Tracking

(Not tracked)

RESOLVED FIXED
Thunderbird 3.0b2

People

(Reporter: jamesrome, Assigned: standard8)

References

Details

(Keywords: regression)

Attachments

(3 files)

In 3.0a2pre (2008060603), whenever I start the program, I must enter the Master Password 3 times. This also happened with earlier builds.

OS X 10.5.3
bug 348997 (browser, kinda related), bug 338549 (password prompts in general not serial at startup)
Depends on: 338549
This has gotten worse. Now one of the password boxes is displayed with no writing on it, so the user does not know what it is for.
There is no reason to be asked for my password 3 times at startup!
I just started seeing this -- not three times, but roughly the number of tabs that need a password when they open. Today, I installed a new version of Flashblock, and at that point there were some 10 tabs open, six requiring passwords. I was asked I think 7 times (one where the box had no title and was at the top of the window).

I tried disabling flashblock but no help; I tried disabling the Master Password, restarting, and setting it again, still no help. This wasn't happening for me yesterday (no updates to my system except for Flashblock, and if there was a Mozilla update I didn't notice).

Mac OS X 10.5.4 (Intel)

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.1) Gecko/2008070206 Firefox/3.0.1 (Firefox and all extensions are at the latest version)
I'm seeing this on OSX.  But it's only two times for me.  

I've seen bugs like this lock smartcards that have a 3 strikes policy.

This still happens to me.

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b1pre) Gecko/20080903025653 Shredder/3.0b1pre
Keywords: regression
I believe/suspect that this is a duplicate of bug 338549.

The workaround that I use is:
I have all my mail and news accounts configured to not automatically 
"check for new messages at startup".  I manually initiate the login 
to each server, as I'm ready to start reading messages from that server.
This has the beneficial side effect that I don't get a master password 
prompt for every account.
In comment 6, I described part of my workarounds for this problem. 
Here is another part of my workarounds.

When the user logs into an IMAPS account, such as when right clicking on 
the IMAPS account name or icon and selecting "Get Messages for Account",
the client may establish some number (typically 4) connections to the 
IMAPS server in very rapid succession.  Each of those connections may 
present a password or master password prompt, resulting in up to 4 
password prompts displayed simultaneously.

The workaround for this is to not use "Get Messages For Account" as the 
FIRST operation on an IMAPS account.  Instead, when you want to login 
to your IMAPS account, click on any one of the folders under that 
account.  That will create a single connection for that one folder.
Once you have logged in to that account (having used your master password)
THEN go and right click on the account name/icon and select "Get Messages
For account".  

I really hate having to do that, but it beats multiple simultaneous password
prompts.
Attachment #326675 - Attachment description: dosplayed dialogs → displayed dialogs, one with no text
Yes, but this is still a royal pain. The old Thunderbird did not have this behavior, so it is a bug and should be fixed.

Please vote for this bug.
Yes, it's a regression.  It's over two years old.  See Bug 338549.
I see no signs of it being fixed any time soon, sadly.
patch upcoming
Assignee: nobody → bienvenu
Flags: blocking-thunderbird3+
OS: Mac OS X → All
Target Milestone: --- → Thunderbird 3.0b1
Attachment #349806 - Flags: review?(bugzilla)
Whiteboard: [has patch, needs review Standard8]
Hardware: PC → All
Attachment #349806 - Flags: review?(bugzilla) → review+
Comment on attachment 349806 [details] [diff] [review]
[checked in] proposed fix

Ok, this should fix it for most users, so r=me.

General note: this is the first in an intended set of improvements related to bug 338549 to improve Thunderbird/SeaMonkey's password handling. This is an easy way to improve part of the experience for beta 1.
Whiteboard: [has patch, needs review Standard8] → [bienvenu to land patch]
fix checked in.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Whiteboard: [bienvenu to land patch]
I am using shredder 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3pre) Gecko/20081129 Lightning/1.0pre Shredder/3.0b1pre 
and still have to enter the password several times. Usually I get as many password windows as I have mail-accounts and subscribed calendars in lightning. Sometimes only two of them have text and the others are empty and can be closed without entering a passord. Is this another effect than the one fixed in this bug?
(In reply to comment #14)
> I am using shredder 
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3pre) Gecko/20081129
> Lightning/1.0pre Shredder/3.0b1pre 
> and still have to enter the password several times.

Do you use a master password? or do you input different passwords for each of your accounts. This bug only fixes it for master passwords.
Sorry i forgot to mention that I am using a master password.
This patch fixed it for me :-)
I just restarted shredder and was asked 11 time for the master password. 
I have 3 mail accounts and 8 subscribed calendars.
After having typed in all passwords the error console shows:
Warning: Timed textboxes are deprecated. Consider using type="search" instead.
Error (24 times): a._updateVisibleText is not a function
the new password work seems to have regressed this - I have 3 or 4 accounts set to check new mail at startup, and now I'm getting 3 or 4 master password prompts on startup.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Target Milestone: Thunderbird 3.0b1 → Thunderbird 3.0b2
(In reply to comment #20)
> the new password work seems to have regressed this - I have 3 or 4 accounts set
> to check new mail at startup, and now I'm getting 3 or 4 master password
> prompts on startup.

Hmm, I don't know how that happened. I'll take a look in a while.
Now I also am prompted several times, though one is too fast for me to catch.

I was also asked to supply my IMAP password, which I had previously saved.  Maybe that's a clue?
For me this behavior started after this build:

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b3pre) Gecko/20090115 Shredder/3.0b2pre
Duplicate of this bug: 474214
I'm pretty sure I know why this regressed and what to do to fix it, hence stealing bug.
Assignee: bienvenu → bugzilla
Importance -> Major!?
Duplicate of this bug: 405221
Attached patch Fix regressionSplinter Review
This should fix the regression. I've only tested with one account, but the master password dialog comes up at the same time as when it did when this was originally working ;-)

The problem was we were searching for an incorrect hostname/realm combination (using the defaultServerUri will never match now), and so no logins were being returned - toolkit login manager allows this search to take place without prompting for master password.

The revised fix is based on the password manager code for the show passwords dialog and should be much more versatile (and won't require a specific account to be found) - it basically gets the token for the master password and tries logging into it manually: http://mxr.mozilla.org/comm-central/source/mozilla/toolkit/components/passwordmgr/content/passwordManager.js#184
Attachment #357580 - Flags: review?(bienvenu)
Attachment #349806 - Attachment description: proposed fix → [checked in] proposed fix
Comment on attachment 357580 [details] [diff] [review]
Fix regression

thx, yes, this fixes it for me.
Attachment #357580 - Flags: review?(bienvenu) → review+
Checked in: http://hg.mozilla.org/comm-central/rev/4c6563dcabef (in time for today's nightlies).
Status: REOPENED → RESOLVED
Closed: 12 years ago11 years ago
Resolution: --- → FIXED
In the latest nightly:
1. Thunderbird suddenly seems to have lost all my account passwords
2. It suddenly keeps bugging me for a master password, even though I have never had one

Is that a regression from this?
Sorry, please ignore me. The nightly where this is fixed is probably not up yet.
Anyone else have this regress on last nights MacOSX build?

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1pre) Gecko/20090626 Shredder/3.0b3pre

I'm getting a Master Password pop-up that comes up and dismisses itself, another one pops up, waits for me to type the password, then a third one pops up. I'm not reopening until can verify it is happening to them as well.
Confirmed, on win32 client.
FWIW, the main window comes up before the password dialog, which is the behavior that caused the bug in the first place, and what caused it to regress last time, as well.
Reopening with confirmation. Leaving the blocking-thunderbird3 flag from bienvenu. If it was blocking then, should be blocking now.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
the ui refactoring probably lost this little hack...
Target Milestone: Thunderbird 3.0b2 → Thunderbird 3.0b3
Blocks: 501212
Ok folks, let's do this properly. When we get regressions we file new bugs rather than reopening existing ones, especially when we've not backed out the bug that did the fix and we've had one release in between.

Therefore marking this as fixed again and I've filed bug 501212 to cover the new regression.
Status: REOPENED → RESOLVED
Closed: 11 years ago11 years ago
Resolution: --- → FIXED
Target Milestone: Thunderbird 3.0b3 → Thunderbird 3.0b2
You need to log in before you can comment on or make changes to this bug.