825835 - Master password should be required to setup sync and display recovery key

Status: RESOLVED DUPLICATE of bug 1013064

(Firefox :: Sync, defect)

Description

[Radek Dostal]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0
Build ID: 20121129165506

Steps to reproduce:

1) Choose Menu -> Edit -> Preferences -> Security
2) Make sure master password is enabled
3) Click on saved passwords
4) Enter your master password
5) Click on Show Passwords
=> Master password is prompted again, as somebody could get temporary access to the computer and could be steeling passwords from you. This is correct.
6) Choose Menu -> Edit -> Preferences -> Security
7) Click on "Pair a device" or "Manage account" -> "My Recovery key"


Actual results:

You are not requested to re-enter master password, if you have entered it sometime before.


Expected results:

You should be requested to re-enter master password as this could lead to more serious leak of passwords then clicking on "Show Passwords", where password is re-requested.

Comment 1

[Patrick Seiter]

I can confirm this and agree that the master password should be required to display the recovery key.

Comment 2

[Lina Butler [:lina]]

The recovery key was part of old Sync, which no longer exists. New Sync stores FxA credentials in the password manager as of bug 1013064.