587072 - Password not encrypted in activity log

Status: RESOLVED INVALID

(Firefox :: Sync, defect)

Description

[Tony Chung [:tchung]]

Attachment: password plain text

My password is being displayed in plain-text when syncing and looking through the logs.   See attachment

* In log file, Scroll down near the bottom, and notice the "password":"<XXXXXXXX>" has been edited and once showed my real password for that site shown in plain-text

Tested with integrated sync nightly: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b4pre) Gecko/20100813 Minefield/4.0b4pre

Comment 1

[Philipp von Weitershausen [:philikon]]

Looks like you changed your services.sync.log.logger.engine.passwords preference to Trace. That puts the passwords engine's logger into TRACE mode. It will be extremely chatty and print stuff like the raw data that is being synced.

As this isn't a problem that should happen for the regular user I'm inclined to call INVALID on this one, but other people may disagree.

Comment 2

[Richard Newman [:rnewman]]

Invalid it is. If you're poking about in about:config and setting password logging to TRACE, this behavior should be no surprise :)