904673 - Canceling master password request when accessing saved password opens password window

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager, defect)

Description

[Florian Bender]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20130806170643

Steps to reproduce:

1. Save a password. 
2. Set up master password. 
3. Access "Saved passwords …", master password prompt appears. 
4. Click "Cancel". 


Actual results:

The "Saved passwords" dialogue appears (however, it's empty, at least in my tests). 


Expected results:

The "Saved passwords" dialogue should not appear at all. 


Narn found this and reported this at http://nakedsecurity.sophos.com/2013/08/08/chrome-firefox-display-plain-text-passwords-with-a-few-clicks/#IDComment698353134

Comment 1

[Florian Bender]

I tested this BTW on the latest Nightly 26.0a1 (2013-08-13), too.

Comment 2

[Rika Pi]

Confirmed in Firefox Beta 28.0b7

Comment 3

[Rika Pi]

Confirmed in Nightly 30.0a1 and Aurora 27.0

Comment 4

[Tracy Walker [:tracy]]

It's confusing that the view password dialog comes up after Cancel. But as the reporter noted, there are no passwords shown in the dialog.

Comment 5

[Justin Dolske [:Dolske]]

It's generally agreed among UX/Engineering/Product that we don't want to further develop the existing master password functionality, as it's a poor fit for current needs and our current direction in this area.