690754 - Master password dialog in Fennec pops up too often and gets in the way when you don't want it

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: General, defect)

Description

[Guillaume Destuynder [:kang] [this account is no longer active]]

Use case:
- I have my passwords encrypted on the device using the master password
- I am on the go and want to check 2-3 web pages quickly, so I start Fennec
- The page I load is one where some of my authentication data is also stored in Fennec, which triggers a Master password popup, which I have to enter, or cancel

a) I cancel the dialog because I just want to read something on the side, but after i touch a link the dialog pops again, which is rather irritating even if technically understandable

B) I input the password, which takes forever on mobile, and is just as irritating, so next time i'll just start another browser if I don't care for my passwords and want to browse a couple of pages (not really, but I expect many to do that)

Proposed solution:
Implement the master password prompt differently.
A quick hack would be to add a button "don't ask me again for this session" or "don't ask again for 15min" etc, but that's not very good either (need to restart the browser when you'll actually need the master password)

Instead, what about having a button in the right side bar or in the awesome bar that indicates the credentials storage is locked by the master password, so if you want to unlock it, you just touch it, then the master dialog popups.
That way, you only get to input the password when you decide.

Comment 1

[Brion Vibber]

I'd actually suggest using a lightweight Android service to keep the master password unlocked while the phone's running, similar to keychain services on various operating systems.

What I really want the master password for is to protect stored passwords, sync account etc from someone who manages to get at my phone and slurp out its storage (say, by plugging the phone in and copying files or taking out the SD card :P)

Since the phone itself has a screen lock already, I'm perfectly happy to let Firefox keep its password unlocked the whole time my phone is running, just as it does on my desktop where Firefox is *always* running.

But on mobile, Firefox closes out frequently in the background, so a lot of times going to a new web page launches the app anew and triggers the password dialog.

If a lightweight service can stay in the background and _not_ get closed, and each fresh Firefox launch can connect to it and start up sync, password remembering etc without a manual password input that would be *awesome* for me.

Comment 2

[Brad Lassey [:blassey] (use needinfo?)]

the better fix for this would be to put master password in the saved instance bundle, such that if we get paged out by the system you'll still be logged in. But if you quit explicitly, you'll get logged out. That would be closer to the desktop experience.

Comment 3

[Brion Vibber]

(In reply to Brad Lassey [:blassey] from comment #2)
> the better fix for this would be to put master password in the saved
> instance bundle, such that if we get paged out by the system you'll still be
> logged in. But if you quit explicitly, you'll get logged out. That would be
> closer to the desktop experience.

Excellent, that sounds like it should do the job!


Reference info:

<https://developer.android.com/reference/android/app/Activity.html#ProcessLifecycle>

<https://developer.android.com/reference/android/app/Activity.html#onSaveInstanceState%28android.os.Bundle%29>

Comment 4

[BMO Automation]

Closing all opened bug in a graveyard component