460868 - Password manager asks for multiple master passwords if you cancel (i.e. don't wish to log on)

Status: RESOLVED DUPLICATE of bug 385951

(Toolkit :: Password Manager, defect)

Description

[Dak]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3

if a site has a logon form on every page, and you have a master password set, and you don't wish to log on (i.e., cancel the 'enter master password' prompt), then you will be prompted every time you navigate to a new page within the site.

Reproducible: Always

Steps to Reproduce:
1/ with master password set on, find a site that you're registered at, that you've told firefox to remember your password for, but that you haven't told the site to remember you (i.e., shouldn't auto-log-on, but should auto-fill the login form). everything2 does it for me.

2/ visit said site.

3/ click 'cancel' when prompted for the master password.

4/ try to browse the site.
Actual Results:  
 because every page has a logon form, every single navigation will pop a master password prompt >:-(

Expected Results:  
the master password prompt should appear once then bugger off for the rest of the session unless the site is navigated away from then back to, or the logon form is actually focused.

most people use the master password so that people who have a few minutes access to their computer can't check the preferences > saved passwords list.

mayhaps there should be an option to JUST password-protect this list?

or the password prompt should be much less intrusive/more ignorable

Comment 1

[GJ Sterenborg]

I can confirm this, running ubuntu 8.10.

Comment 2

[RNicoletto]

I can confirm this.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7

Comment 3

[Oscar Megia]

Also if you close Mozilla with multiple pages with password the next time you open Mozilla it will ask for the Master password as times as tabs you have saved the password. Does not matter if the first time you type the correct Master Password, Mozilla will ask you again and again ...

Is very annoying!!

It will be much better if only ask one time for the Master Password.

Regards
Oscar

Comment 4

[RNicoletto]

Yesterday bug 475053 landed on trunk.

Anyone experiencing this bug is invited to test latest trunk (possibly with a
clean profile) and report results here.

Comment 5

[luarvik]

The whole behaviour of the mastep password prompt is exactly one thing, why I prefer Opera to Firefox - Opera pops master password prompt only when I really want to login on page, which has saved password in my password database - NOT when the page/pages are opened, but only when I want to login on that page (by hitting Ctrl+Enter). 

It is completely beyond me, how this multiple master password prompt bug with all of its variations is still up for more than two years..

Comment 6

[Lecker Kebap]

It is 2011 now, and this bug is still alive and extremely annoying. Please fix! This is happening both in Firefox 3.6.18 and Firefox 4 and 5.

Comment 7

[Dak]

I don't care anymore, as I don't need the password manager's master-password feature.

But, i've changed some of the bug's fields in case that helps bump the problem.

If someone can change the 'status' from Unconfirmed to Confirmed, that might help.

Comment 8

[Flávio Etrusco]

Sorry for the noise, but what do you mean you don't need the password manager? What's the alternative? (full disk encription isn't a valid one ;-)

Comment 9

[Honza Bambas (:mayhemer)]

This is probably not that hard to fix.  Problem here is, how to easily allow user to log in again.  Also questionable is if this is a valid use case.

A few minutes ago my friend used my Fx profile with the master password set to check her gmail inbox.  I was not logged in at that moment so the MP dialog popped up, I told her just to cancel.  She had to do that 2 or 3 times.  This could be considered annoying.  But if first cancellation would prevent any further MP prompt, how could I log in now?

Any of you here is free to code an experimental extension that could try to solve this issue.  That extension could then be adopted to Fx code base if found useful.

Comment 10

[Oscar Megia]

This is solved:
You only need to press refresh button to log in again and mozilla will show you the window asking password.

Comment 11

[Dak]

That's the problem: the sheer number of times that FF asks for the master password when you don't want to log in (e.g., on a page-refresh).

Maybe, after having been told to gtfo once, the master-password box shouldn't reappear until and unless you click in a password box, indicating you want to log-in? or maybe something similar to Opera's login-wand? 

IIRC, don't they have a little button auto-added within user/pass boxes that you can click to auto-sign-in? Or are they yellow, and you have to Ctrl-click? or click the wand button or something?

-------

Flávio: no longer living in a shared house with people I don't trust. I didn't want them to be able to view my password-list when I was afk, but with a bit more convenience than screen-lock, so I turned password manager on.

Comment 12

[Lecker Kebap]

My main problem is somehow related to this, should I start a new bug for it?

Whenever I start Firefox anew, and have some tabs open that have password fields in them, I get a dozen popup-boxes at the same time, asking for my master password. 

Now the original problem here was, that 1 of these boxes would keep re-appearing some times when I click cancel. This should be reduced to 1. 

However, I also only need 1 box in total at this time, not 1 for each tab. 

I can only prevent this, by entering my password as quickly as possible into the first popup that appears, and pressing enter hopefully before the next popup appears. This would then work and no additional popups would surface. 

However, if I am too slow, the second popup will pop right into me typing the password, which is then spread over 2 or more popups, which I have to delete and fill anew, if I want to stop further popups...

I hope I explained my problems in a little more understandable way. Now again the question, if this can be included here or should rather be spit off?

Comment 13

[Luc Mousseau]

I have the same problem as Lecker, a saved session with multiple tabs with logins on each generates multiple MP prompts, which as he stated interfere with eachother, so if you're typing in one and another comes up, it takes focus.. Really annoying.

I don't think it requires another bug though, since IMO the source of the issue is the same (ie: the Master Password prompt).

The solution for this seems simple to me though:

1. DON'T use a modal dialog box for the prompt. Instead use the same mechanism used by other parts of the password management: the notification bar. This way any tab / window that has a password won't steal focus away waiting for the master password to be input.

2. Only ask once! If I enter my master password in one spot (whether that be a modal prompt or a notification bar), it should apply EVERYWHERE, and I shouldn't have to reload the page, enter it again or hit cancel in every tab or window the MP prompt appears.

3. Perhaps allow more options than just plain "Cancel". For example "Cancel for this session", or "Cancel for this site", etc... (Of course, if it were using a notification bar, it could easily also simply be ignored since it's unobtrusive and doesn't steal focus away from the actual web page you're viewing.)

4. If you've previously cancelled, it should only show the master password prompt again if you actually FOCUS a login form. Obviously Firefox is smart enough to know there's a login form on a page (since it'll insistently prompt you for the MP when it is), there should be no reason why it can't be smart enough to know when you've clicked or tabbed into a login field (keeping in mind #1, in order to NOT be annoying). 

And personally I'd probably be happy if just #1 were implemented.

Comment 14

[Luc Mousseau]

Bug 513534 - "Login forms in background tabs should never cause master password dialog to appear" is essentially the problem Lecker and I are having (I knew I had commented on this issue before... 2010..). 

But again as I said above the problem is essentially the same, and the solution I suggested would essentially solve both bugs.

Comment 15

[Dak]

Does someone want to mark this bug as 'confirmed' to draw attention to it?

Comment 16

[RNicoletto]

As per comment 15.