93750 - Correct passwords weren't acceptet

Status: VERIFIED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Lasse]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:0.9.3) Gecko/20010801
BuildID:    2001080110

The masterpassword-management accept passphraes,
which auto-login-sites doesen't accept.
So, a set password will not be acceptet, even it is
correct.

Reproducible: Always
Steps to Reproduce:
1. Set a new masterpasswort (passphrase), for example "this is the test phase".
2. Enter a website, which is in your stored-password-database.
3. Enter the passphrase. Mozilla will say, it's wrong.
4. Go the Masterpassword-Management and change that passwort.
Enter the old passphrase, and set a new, single-password now. However,
that will work.
5. Try to enter the website again, and then enter the new, single-password.

I don't know wether the component "daemon" is correct.

Comment 1

[Stephane Saux]

tested with windows x86 Build Id 2001080904.
After setting my software security device password (master password) to "this is
a test" I was able to successfully visit a site with a stored password, and
enter the master password when prompted.

Try a newer build, or maybe you didn't enter the pwd correctly (according to
your account a pwd of "a a" should fail).

Marking works for me.

Comment 2

[ckritzer (gone)]

Reporter, I'm not sure I understand step #3:

Steps to Reproduce:
1. Set a new masterpasswort (passphrase), for example "this is the test phase".
2. Enter a website, which is in your stored-password-database.
3. Enter the passphrase. Mozilla will say, it's wrong.
4. Go the Masterpassword-Management and change that passwort.
Enter the old passphrase, and set a new, single-password now. However,
that will work.
5. Try to enter the website again, and then enter the new, single-password.

I get no such dialog asking for a master password.

Stéphane, is that a new bug?  Should we be getting a master password dialog 
whenever a stored name/password combo is about to be submit in a form where it 
has prefilled said items?

Comment 3

[Stephane Saux]

Chris:
Make sure you have the taks->sec&priv->pwd mng->encrypt sensitive info set.
Then store some password.
Then change master pwd to some phrase.
Restart the application.
Go to the site, you'll get prompted to enter the master pwd, and you can enter
the passphrase which is accepted, and the site pwd is filled correctly.  I don't
see a bug here, although you are right that the steps to reproduce are wrong.
You don't get prompted.

Comment 4

[Stephane Saux]

Assigning target of 2.1 to all bugs fixed in the 2.1 target timeframe whose
target was not 2.1

Comment 5

[Christina Fu]

verified to work on N6 2001091703 win2000

Comment 6

[Stephane Saux]

marking as verified as per cfu's comments.

Comment 7

[Christina Fu]

I am going to retract the "verified" status.  I realized that the very first
time I've been asked to type in that master password, it never accepts it. 
Yesterday, I just assumed that I mistyped, but today, after several try, I am
pretty certain that it doesn't accept my "this is a xxx" password on first try.
Can somebody try this out too?

Comment 8

[Christina Fu]

ok, verified again.  The symptom I saw has little to do with this bug.  Whether
it's a bug or feature, it should be a separate thread.