523910 - Password manager prompts on browser startup even when Mail check is disabled

Status: RESOLVED WONTFIX

(SeaMonkey :: Passwords & Permissions, defect)

Description

[Adam]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.4) Gecko/20091017 SeaMonkey/2.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.4) Gecko/20091017 SeaMonkey/2.0

Password manager prompts for master password on browser start up, before the browser itself is visible, even when the "Only check for new mail after opening Mail & Newsgroups" option is selected. This happens irrespective of homepage (i.e. it isn't the homepage requesting access to password manager). This issue has also occurred on Ubuntu 9.04 running: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.5pre) Gecko/20091017 SeaMonkey/2.0.1pre although this profile does not have any mail or news accounts configured.

If you cancel the master password prompt once, it does not reappear and the browser opens successfully.

Resetting the master password appears to resolve the issue, at least in the short term, but obviously this results in the loss of all saved password data.

Reproducible: Couldn't Reproduce

Steps to Reproduce:
In both cases that I have experienced I have been unable to successfully reproduce the problem after resetting the master password.
Actual Results:  
Browser prompts for master password before opening.

Expected Results:  
Browser should open without prompting for master password

Comment 1

[Robert Kaiser]

This is likely happening due to bug 381269, you can turn off signon.startup.prompt in about:config.

Jens, do we have a bug report to dupe such bugs to?

Comment 2

[Jens Hatlak (:InvisibleSmiley)]

(In reply to comment #0)
> Resetting the master password appears to resolve the issue, at least in the
> short term, but obviously this results in the loss of all saved password data.

Setting an empty Master Password (Edit/Preferences/Privacy & Security/Master Password/Change Password; enter current Master Password after "Current password:" and press OK) will keep your login data and just disable encryption.

(In reply to comment #1)
> This is likely happening due to bug 381269, you can turn off
> signon.startup.prompt in about:config.

Correct (both).

> Jens, do we have a bug report to dupe such bugs to?

Not that I knew; I'd say WONTFIX (in the sense of "not for 2.0") this one and use it as such.

@Adam: That doesn't mean the we don't recognize the problem. Actually we do. It's just that we cannot fix it for 2.0.* because this has been implemented as a workaround for something that needs to be fixed in multiple places, notably MailNews (shared back-end with Thunderbird) and Core (shared back-end with Firefox). Both underlying issues are being worked on and will hopefully be fixed in SeaMonkey 2.1 (*not* 2.0.1!).

Comment 3

[Adam]

The signon.startup.prompt change has resolved the issue; though in reference to bug 381269 I don't have any IMAP mail accounts and I'm not getting multiple prompts.

Is it worth making the suggestion to either set signon.startup.prompt to false by default or providing a GUI option to change it, as I imagine a fair few people will fall foul of this when SeaMonkey 2.0 goes final.

Comment 4

[Robert Kaiser]

Adam:
2.0 final has been done in any case and will be released as it now (i.e. RC2 will be converted to final without any further change).

The problem here is that in either case of the signon.startup.prompt setting, we're running into problems, and we know that and did know that when introducing that workaround, but a real solution was not possible for the 2.0 series with our small team and less in-deep knowledge of all the code that calls (master) password prompts.
Either those people have multiple master password prompts that have multiple email or website passwords being requested at startup, or those people have one master password prompt at startup who are not actively using the master password at startup - both are suboptimal, but we figured that the former case was more annoying and more frequent, so we built this workaround with the default to do the prompt, and offered the possibility to flip the pref for the latter group of people.

We'll closely watch how it works out for 2.0 final and work on getting a better solution for the 2.1 series, but right now we are stuck with no way out and no way to fix this in a way that makes everyone happy. I'm unhappy with this situation myself, but for now we WONTFIX this but only watch reactions closely.

Comment 5

[Jens Hatlak (:InvisibleSmiley)]

(In reply to comment #3)
> Is it worth making the suggestion to either set signon.startup.prompt to false
> by default or providing a GUI option to change it

Defaulting the pref to false isn't any better since that would just move the bad experience from your use case (MP set up but not broadly used, i.e. no MailNews use) to the probably more common one (MP set up, mail/news accounts with saved login credentials checked at startup). There is no GUI option for this because the workaround was added late in the game and really only meant as just that, a workaround. If we added a GUI option that would suggest we accept this as a real solution which I think we don't. Note that this is only my opinion, though; you'd have to ask the Council or responsible reviewer (Neil, probably) for a definitive answer.

> I imagine a fair few people will fall foul of this when SeaMonkey 2.0 goes
> final.

Maybe we should relnote this to help end users. The note currently reads:

"MailNews account password prompts are no longer serial at startup (Bug 338549)
Workaround: If a Master Password is set and you saved your login credentials, only one prompt will appear at startup."

Suggestion:

"MailNews account password prompts are no longer serial at startup (Bug 338549)
Workaround: If a Master Password is set and you saved your login credentials, only one prompt will appear at startup. You can disable this new behavior by setting signon.startup.prompt in about:config."

Comment 6

[Adam]

Sorry, just to clarify, I do have two MailNews accounts saved with the MP, they're just POP3 rather than IMAP & I've only ever had a single prompt for them; as well as regular website credentials being saved.

I understand about the GUI option and SM2 being final as of RC2, but I haven't seen any negative behaviour since making the config change - I'm still prompted for the MP whenever it's needed in web browsing or MailNews, just not on browser start up when it shouldn't be needed (In my case, at least).

I agree that providing the config option in the release notes will probably be a big help for anyone finding themselves in my situation.

Thanks.

Comment 7

[alexa]

SM2 asks the master password on every start even if there is no mail account at all.

IMHO the default should be not to prompt on startup, as the new behaviour is extremely annoying and puzzling.

At least the release notes should clearly tell about this!
Suggestion: 
"When a master password is set, SeaMonkey will prompt for it on every startup of the browser or mail/news. You can disable this new behaviour by entering about:config in the location bar and setting signon.startup.prompt to false."

Comment 8

[Robert Kaiser]

It's already mentioned almost the same way you write it here in the sixth item of http://www.seamonkey-project.org/releases/seamonkey2.0/#issues

Comment 9

[alexa]

This item in the current release notes is insufficient because:
1. It only tells about MailNews, whereas the problem is the browser
2. "MailNews account password prompts are no longer serial at startup" doesn't point to the problem and is easily overlooked.
3. "only one prompt will appear at startup" is not as clear as "on every (!) startup"