540790 - Misleading text in pop-up window: 'Password Required; Please enter the master password for the Software Security Device.'

Status: RESOLVED DUPLICATE of bug 306730

(Thunderbird :: Security, defect)

Description

[Ralph Cohen]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6
Build Identifier: 20100115132715

In addition to 'Software Security Device' this pop-up should also mention the master password for 'Passwords' since enabling that option will also trigger this pop-up.  

Reproducible: Always

Steps to Reproduce:
1.Remove any password for Software Security Devices.
2.Enable a master password for 'Passwords'.
3.Restart Tbird.

Actual Results:  
The 'Password Required' window will pop-up requesting the 'Security Device' master password but no mention appears requesting the master password for 'Passwords' to be entered.  Entering the master password 'Passwords' is accepted by the dialog box.

Expected Results:  
I expected the pop-up to say the following: "Please enter the master password for Passwords"

If a separate dialog cannot be created, then a change in the text to "Please enter the master password for Passwords or Software Security Device." may eliminate some confusion.

Comment 1

[Ludovic Hirlimann [:Usul]]

Do you have FIPS enabled ?

Comment 2

[Bob Walter]

If it is enabled by default, then yes.

Comment 3

[Ralph Cohen]

(In reply to comment #1)
> Do you have FIPS enabled ?
No, FIPS is not enabled on this system, i.e. the 'Enable FIPS button on the Device Manager window is not grayed out and is clickable.

Comment 4

[Lysathor]

I also find the dialog a bit confusing. Please also add "Thunderbird" to the Dialog title, because other mozilla also shows exacly the same dialog when master passwords are used. (When I start Thunderbird and Firefox I get two or more such dialogs, and because the dialog does not tell if it is Thunderbird's or Firefox's dialog, I had to choose the same master passwords...).

Comment 5

[Stormy Peters]

The dialog is terribly misleading.

It asks for your password for "your master security device". I had just set my password and still had to think for a minute about what my master security device might be.

I would recommend replacing the text with "Please enter your master password." or "Please enter your master Firefox password."

Comment 6

[Rikard Fröberg]

I agree that this is misleading. When I boot up my laptop and re-open firefor and have some tabs re-opened that requires login, I get one of these dialogs for each tab. If I open my email client while waiting for firefox to load, I get a different popup asking for my keyring password for gnome (alomost equally vaguely labeled, but that's a different issue). I end up with a few requests for some kind of password which must be confusing to new or unexperienced users.

The point here being that it is hard to remember what vaguely labeled dialog asks for what password.

My feel is that each popup asking for a password should be clearly labeled both with what application it is that is asking for a password, and also preferably why, and what the password is for.

Perhaps something like:
[window title: "Mozilla Firefox" (or TB if that is the case)]
"Firefox[or Thunderbird if that is the case] needs your master password to unlock your stored passwords"

On a side-note, perhaps one dialog per browser instance would be enough, as opposed to one per tab, but that might be off topic or a different feature request.

Comment 7

[Rob]

I had to do a google search to find out what was causing the box to pop-up. It should identify itself ie name the application causing it (as already suggested). And the text should be clearer (again as already proposed. I still have no idea why I am being asked this question, I don't know what the password is and so the only thing I can do is cancel - which has no noticeable effect.

Shouldn't everyone who has contributed to this bug also vote for it?

Comment 8

[:aceman]

This needs UI decision.

Comment 9

[Mark Banner (:standard8)]

Actually, this is a core issue so I'm going to mark it as duplicate of the core bug - bug 306730, which has discussions about potential solutions (see especially bug 306730 comment 32).