584618 - password not kept : storage not working with blank/empty password

Status: RESOLVED WONTFIX

(Thunderbird :: Security, defect)

Description

[nls.pct]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.9.2.7) Gecko/20100713 Lightning/1.0b2 Thunderbird/3.1.1

Thunderbird keeps asking for password even if you click "remember password" if you leave password blank.

Reproducible: Always

Steps to Reproduce:
1. Start thunderbird
2. Account will ask you username / password ; Put username, leave password blank
3. Check "remember password" checkbox
4. Close thunderburd
5. Restart thunderbird
Actual Results:  
Thunderbird asks for password.

Expected Results:  
Thunderbird shouldn't ask for password.

Same problem announced here :
http://forums-test.mozillazine.org/viewtopic.php?f=39&t=543095
and here ...
http://forums.mozillazine.org/viewtopic.php?f=31&t=51181

Here is what contains signons.txt file about this account :

trac.xxxxxxxxxxxxxxx.com:80 (Trac authentication)
\=username=\
~bcljd2xhcw==
*\=password=\
~
.

Comment 1

[Ludovic Hirlimann [:Usul]]

Hum does launching Tb in safemode helps ? (http://support.mozillamessaging.com/en-US/kb/Safe+Mode)

Anything in Tools -> Error console when this happens ?

Comment 2

[nls.pct]

Safe mode does not help.
Error console is empty.

Comment 3

[Ludovic Hirlimann [:Usul]]

do you have a signons.sqlite file next to signons.txt ?

Comment 4

[nls.pct]

No, I don't.

Here are the files present in the directory :

abook.mab          extensions.ini  mailViews.dat     urlclassifier2.sqlite
blocklist.xml      extensions.rdf  mimeTypes.rdf     us
cert8.db           GoogleContacts  panacea.dat       US
compatibility.ini  history.mab     prefs.js          virtualFolders.dat
compreg.dat        ImapMail        secmod.db         XPC.mfasl
cookies.txt        install.log     signons.txt       xpti.dat
downloads.rdf      key3.db         SpamAssassin.sfd  XUL.mfasl
extensions         localstore.rdf  storage.sdb
extensions.cache   Mail            training.dat

Comment 5

[Mark Banner (:standard8)]

Is this a regression from Thunderbird 2?

I believe that we generally assume that an empty password is the same as not being supplied a password, and therefore we need to prompt for one.

I'm not sure we'd easily be able to fix this. The work around would be to make your local server require a password...

Comment 6

[Michael A. Pasek]

(In reply to comment #5)
> I believe that we generally assume that an empty password is the same as not
> being supplied a password, and therefore we need to prompt for one.

This is true for POP  (Empty password == "Cancel"), not sure about IMAP.

Comment 7

[Wayne Mery (:wsmwk)]

Several examples - https://bugzilla.mozilla.org/buglist.cgi?f1=short_desc&list_id=11951581&short_desc=blank%20empty&o1=substring&query_format=advanced&short_desc_type=anywordssubstr&v1=password&product=MailNews%20Core&product=Thunderbird

And bug 436085 perhaps should be unduped.

Comment 8

[Wayne Mery (:wsmwk)]

Thoughts on where to take this?

Comment 9

[Kai Engert [:KaiE:]]

Not sure I understand.

Is this about email accounts which are configured with an "empty password" on the server?
Are you saying:

• an empty password is exactly what the server expects
• thunderbird doesn't expect that a password might be emtpy, and concludes "password not yet entered/set"
  ?

Comment 10

[Wayne Mery (:wsmwk)]

(In reply to Mark Banner (:standard8) from comment #5)

...
I'm not sure we'd easily be able to fix this. The work around would be to
make your local server require a password...

(In reply to Kai Engert (:KaiE:) from comment #9)

Not sure I understand.

Is this about email accounts which are configured with an "empty password" on the server?

yes

Comment 11

[Kai Engert [:KaiE:]]

Then I'd like to ask for advice from Alessandro how we should handle this on the UI side.

This is about email accounts that are configured with an empty password.
Apparently Thunderbird code assumes this will never happen, and forces the user to enter a non-empty password, which means the user cannot connect to the account.

I see two possible ways here:
(1) remove the existing checks. Silently allow empty passwords.
(2) add a checkbox next to the password field saying something like "no password required / empty password"

What should we do?

Comment 12

[Andrei [:sancus]]

I would be more inclined to just straight WONTFIX this now that I know it exists than actually expend even 5 minutes on a fix.

Comment 13

[Kai Engert [:KaiE:]]

(In reply to Andrei Hajdukewycz [:sancus] from comment #12)

I would be more inclined to just straight WONTFIX this now that I know it exists than actually expend even 5 minutes on a fix.

Andrei, please confirm:
You are suggesting that Thunderbird should continue to not support email accounts with empty passwords?

Comment 14

[Alessandro Castellani [:aleca]]

I agree.
This looks like a pretty silly edge case. More burden for us to support something borderline useless than for the user setting their own local server to set a 1 character password.

Comment 15

[Andrei [:sancus]]

(In reply to Kai Engert (:KaiE:) from comment #13)

(In reply to Andrei Hajdukewycz [:sancus] from comment #12)

I would be more inclined to just straight WONTFIX this now that I know it exists than actually expend even 5 minutes on a fix.

Andrei, please confirm:
You are suggesting that Thunderbird should continue to not support email accounts with empty passwords?

Yes, I agree with Alessandro. The reason is pretty simple: "fixing" this would involve complicating Thunderbird in some way to recognize a difference between intentionally empty and accidentally empty passwords. But this distinction is irrelevant for nearly all accounts, and the fix on the user's side is trivial - put a password on it.

We should not add unnecessary complication to save a negligible number of users from doing something trivial.

Comment 16

[Kai Engert [:KaiE:]]

Just as a final thought, it sounds like Thunderbird already supports storing an empty password for the account configuration?

If that's true, then potentially it could be a backend code change to try connecting with an empty password, prior to prompting the user to enter a password.

I don't think that's a high priority, but if anyone would contribute a patch for that, together with a test account that we could easily use to test it, then potentially we could consider to take the patch.