814028 - Password Manager saves passwords when not selected to

Status: RESOLVED INVALID

(Toolkit :: Password Manager, defect)

Description

[Selvan]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Build ID: 20121024073032

Steps to reproduce:

"Firefox -> Options -> Security -> Passwords -> Remember passwords for sites".  It is not and never was checked.


Actual results:

Passwords are still stored there.


Expected results:

The browser security option to not remember passwords should take presidence over all others.

Comment 1

[Selvan]

X-notifier is one Add-on that stores the passwords and doesn't offer an option to not.  Even if Add-ons did offer the option, the browser's security settings should supersede.

Comment 2

[Matthias Versen [:Matti]]

An addon can do everything that your user Windows Account permits including sending private data into the internet, formatting a hdd or store passwords

Comment 3

[Selvan]

Yes, granted, I realize nothing is impossible.  But fact remains that if I've set the browser to not remember passwords, it should not.

Comment 4

[Selvan]

If Add-ons, or the like, are going to be allowed to remember passwords, unbeknownst to the user, it deems this security option misleading and pointless, and the average user vulnerable to a security hole.

In the interim, I have assigned a master password so as to, hopefully, take back total control of this sneaky password saving behavior.

Comment 5

[(mostly gone) XtC4UaLL [:xtc4uall]]

I see you already posted your Issue to the Addon-Author per http://xnotifier.tobwithu.com/wp/forums/topic/x-notifier-password-storage-concern

I guess this is - if at all - a Matter of Add-on Review Process, no?

Comment 6

[Selvan]

I beg to differ!

With at least 1/3 of users having an add-on installed, and with the billions of add-ons available, I feel the better solution is to fix the browser which implies it has the ability to not remember passwords.

It is, without a doubt, a security hole.

Comment 7

[Matthias Versen [:Matti]]

As I already explained, an addon can do everything and you can't fix that in the browser.

Comment 8

[Selvan]

Security Option: "Warn me when sites try to install add-ons"

Perhaps "Warn me when add-ons (or anything browser dependent) try to remember passwords" could be added?

Please, something should be done.  As is, the user is left with a false sense of security.

Accepted, "Remember passwords for sites", does not pertain to add-ons.

Comment 9

[Justin Dolske [:Dolske]]

The checkbox controls Firefox's own website password detection-and-saving. The password manager is also provided as a general service for things wanting to store passwords (for example, Sync stores your sync key here).

What addons do is up to them.