639686 - Stored passwords can be viewed without entering the master password a second time

Status: RESOLVED DUPLICATE of bug 571997

(Toolkit :: Password Manager, defect)

Description

[sworddragon2]

User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:2.0b12) Gecko/20100101 Firefox/4.0b12
Build Identifier: Mozilla/5.0 (X11; Linux x86_64; rv:2.0b12) Gecko/20100101 Firefox/4.0b12

I have some passwords stored and protected with a master password. If I want to see them in the preferences I need to enter my master password first. After I typed the correct password I'm able to see the site and the username but not the passwords. To see the passwords I need to enter my master password a second time but there is a way to view the passwords without entering the master password a second time. Just right click the wanted entry and choose "Copy Password". Now the password is in the clipboard in plaintext.

Reproducible: Always

Steps to Reproduce:
1. Open Edit -> Preferences -> Security -> Saved Passwords...
2. Enter your master password
3. Right click any entry and choose "Copy Password"
4. Paste the content from the clipboard in any editor
Actual Results:  
I can see the password in plaintext

Expected Results:  
There should be nothing in the clipboard.

Maybe the second confirmation of the master password is unneeded and the function can be removed. After the first entering of the master password the user want to see the passwords and not entering the master password a second time. The second entering of the master password isn't a security feature. It's just a pseudo-security.

Comment 1

[[:Aleksej]]

Thanks for the report.