Reveal password security

[Kimco]

Hello. I recently realized that the recent release of Mozilla had the reveal password feature. As much as this is a great feature, it circumvent the master password security feature. To clarify, the master password was put there to secure our login details. However with this new reveal password feature, anyone can just see the password without the need to enter the master password. What is the need for a master password if the reveal password feature renders it useless. I want the reveal option to be linked with the master password as well. If you need to reveal your password, you need to enter the master password. That will make it much more secure like it intended to be. Thank you.

[Jon]

Thanks for submitting an idea to the Mozilla Connect community! Your idea is now open to votes (aka kudos) and comments.

[CakesTheMacMan]

In addition to FF offering its own method for revealing passwords without requiring the Primary Password to be entered, some websites show the eyeball icon in their password fields.  Both of these methods will reveal passwords entered automatically by the FF password manager.

I would like to be able to store passwords for use, but I never want them visible unless I enter my Primary Password.  This is a feature that Safari had on Mac for at least 20 years.  Are web sites overriding this somehow?

I can understand having the eyeball feature for when you are manually typing in a password, or when you are creating a new password... but it should always be disabled when using a password manager.

[Isabella]

Hi @Kimco as of version 127, you can enable OS authentication for passwords - just navigate to settings and enable "Require device sign in to fill and manage passwords". Firefox will then ask you for your device password before revealing any saved passwords.

[CakesTheMacMan]

Thanks @Isabella but I don't see that option in FF 129.0.  I am on Linux, but I am not sure that matters.  All I see is Primary Password, which does not lock down the password visibility outside of the password manager.  I have the Primary Password option turned on, so FF asked me to enter it at launch and doesn't ask again unless I want to use the password manager.  Any saved passwords will be auto entered on websites.  Some of those websites offer their own eyeball option which will display the auto-entered password.

Many of these websites have only recently added this feature.  Previously it was not a problem.  I could simply remove those saved passwords for those particular sites... but that wouldn't help with other sites if they chose to implement that eyeball feature at some point in the future.

[Isabella]

Hi @CakesTheMacMan - thanks for sharing the operating system you are using because that indeed matters in this case. OS Auth is currently not available on Linux. Are you still using Linux? If so, I can look into why it's not available on that system and get back to you.

[CakesTheMacMan]

Yes, I use Linux daily. I also use macOS and Android daily. The problem with Firefox revealing auto-entered passwords is universal across those three platforms.

[mikedIBM]

After using Firefox since the Netscape days, I am done. I discovered this security regression today while searching settings for settings related to containers.

I am using Firefox 159 (32-bit) on Windows 10. (My Windows has security updates until next year while I migrate my remaining Windows machines to Linux.)

The new sidebar Passwords shortcut allows any curious observer sitting at my PC to view my accounts and reveal plaintext passwords without entering my Primary Password. Device authentication doesn't fix the fact that the vault or passwords itself is no longer locked. To make matters worse, an update quietly reset some other privacy settings without me noticing as well ( including turning on 'Open previous windows and tabs' for example).

My usual settings are reasonable security features that forgets most data points on close, with a few exceptions.  So you can understand my surprise to notice an option like Open previous windows and tabs is enabled.    

Because I let friends use my machine while I'm around, as a precaution, I now have to spend hours changing every password Firefox ever saved, and I am then removing Mozilla products from all my systems and phones entirely. The fact that you can remove a password protection feature without notifying me means you can no longer be trusted with my user security and privacy.  

I also assumed I had choice when it came to configuring firefox but you greyed out the option to check if firefox is the default browser.  I keep settings like that off because I sometimes change default browser and I don't appreciate the nag screens.   So I am certain you re-enabled at some point.

Interestingly enough, on my Android phone, if I am logged into my Firefox account or not, it requires my password to access my password list; my passwords are then revealed without additional interaction other than pressing the eye but at least I need a password to access the list. If the computer version at least had that same requirement I might consider it moderately secure, but I still can't excuse that the password locking feature has been removed for at least a year and I haven't noticed it. I guess that goes to show how often the average user needs to open that feature. Now I have 255 passwords to reset, thanks Mozilla.    

It's not all bad news, it was nice that you added a feature to check sites for data breaches and I am hoping you only relied on the website names, not my personal credentials.  In any event it's not an excuse for allowing any casual observer access to my passwords.    

It's been a nice run, but this is inexcusable.   Good luck.