451508 - Doesn't Ask for master password if i choose "save and quit" while exiting

Status: RESOLVED DUPLICATE of bug 443354

(Firefox :: Session Restore, defect)

Description

[Sorabh Kalra]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1

Use master password to store all the Password in firefox.

When i exit, if i choose "save and quit" [for tabs] and start the firefox next day.It logs me into the few sites without even asking for the Master password.

Now open the site/url [which is either in save and quit history or any page which needs login and in master password database] in a new tab and it asks for the master password now, however i am already logged in some sites which is should not be.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.
Actual Results:  
Does not asks for the master password unless a new page or same page which needs login credentials is opened in a new tab

Security Concern --> Some one can just open the firefox on my machine and he may get the login [access rights] to my accounts which are protected by master password [renedered useless here]

Expected Results:  
Firefox should always ask for the master password, if there are any webapages that needs to be opened requires login and are in my database [Master password]

Comment 1

[Simon Bünzli]

This bug is either a DUPE of bug 443354 or an enhancement request to optionally encrypt the file containing session data so that your tabs and windows can't be restored without a password/your master password. Which one should it be?

BTW: You aren't logged in again into these sites... instead you never logged out, as by choosing "Save and Quit" we keep all the session data around (although most of that will probably time out within a few hours).

Comment 2

[Simon Bünzli]

I guess you wouldn't want to have your session data always encrypted, as in all the cases where you weren't logged in anywhere the additional master password prompt would just get in the way. -> DUPLICATE of bug 443354