87922 - wording for Master Password Timeout is confusing

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[Sean Cotter]

In today's build, the Master Password Timeout options (Preferences/Privacy and
Security/Master Passwords) read as follows:

Netscape 6 will ask for your master password:

* The first time your personal certificate is requested
* Every time your personal certificate is requested
* After inactivity on an encrypted site for XX minutes.

Turns out this is wrong. The way it is supposed to work, each item has to do
with key db access--first time it's accessed in a session, every time, or after
x minutes of not requesting it. (This includes access for the master password as
well as for regular private keys.) Bug 87334 causes the second option to work
incorrectly. However this is the least likely to be chosen, and the other two do
apparently work correctly.

Therefore, we should change the wording as follows:

[browser name] will ask for your master password:

* The first time it is needed
* Every time it is needed
* If it hasn't been used for XX minutes or longer

"or longer" added because (I'm assuming) it won't pop up literally at thirty
minutes, but only if it's needed and 30 minutes or more has passed. 

This wording is also discussed in bug 82377. Filing new bug for wording change
only, which needs to get fixed ASAP.

Comment 1

[Bob Lord]

-> ddrinan

Need a patch and reviews tonight if possible.

Comment 2

[David P. Drinan]

Attachment: Patch. Need review.

Comment 3

[Bob Lord]

r=lord

Comment 4

[Darin Fisher]

sr=darin

Comment 5

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to 0.9.2 branch.
(on behalf of drivers)

Comment 6

[David P. Drinan]

Checked onto branch and trunk. Marking FIXED.

Comment 7

[John Unruh]

Verified.