Categories

(Toolkit :: Password Manager, enhancement, P2)

Tracking

(ASSIGNED bug which should be worked on in the next release/iteration)

People

(Reporter: ckarlof, Assigned: tgiles)

References

(Depends on 1 open bug, Blocks 5 open bugs,

Details

(Whiteboard: [passwords:recipes])

User Story

Sites that could still benefit from this:
* Country code TLDs (aka. ccTLDs): ADP, airBNB, Ancestry, eBay, Amazon, TicketMaster, Eventbrite, eHarmony, FourSquare, GlassDoor, Yelp, etc.
* Microsoft: login.live.com, login.microsoftonline.com
* Comcast/Xfinity: comcast.net, xfinity.com

MIT Licensed list: https://github.com/apple/password-manager-resources/blob/master/quirks/websites-with-shared-credential-backends.json

Some web sites span multiple origins, and the same login credentials can be used to authenticate oneself at all of the origins. I call this the "authentication realm" problem. It comes up in multiple contexts, including:

* the realm allows login on http and https pages
* the realm allows login from multiple subdomains
* the realm allows login from completely different domains

Currently, the password manager will store duplicate entries for each of the origins, which is not ideal, particularly if the credentials ever change.

This is bug is to support recipes to indicate that a set of origins should be treated as "the same" by the password manager for indexing, capturing, and filling purposes.

Two things worry me:
* An evil recipe could steal your passwords from a target site. Are these recipes written/reviewed/released as part of Firefox?
* A recipe that equates origins with different security properties makes users less secure. Especially http vs https.

(In reply to Jesse Ruderman from comment #1)
> Two things worry me:
> * An evil recipe could steal your passwords from a target site. Are these
> recipes written/reviewed/released as part of Firefox?
> * A recipe that equates origins with different security properties makes
> users less secure. Especially http vs https.

I would assume that the user is responsible for umtimately grouping domains together.
The Browser should do nothing but maybe give suggestions that need approval.

We already use the credentials for the non-encrypted version of a website on the encrypted counterpart.
Password changes are not synced back so new password won't be aautomatically submitted on the insecure part.