Mozilla developers released an update through the experiment system without a new release of Firefox 76 and Firefox 77-beta, disabling the new mechanism for confirming access to saved passwords, which was applied on systems without a master password. It is worth reminding that in Firefox 76, for Windows and macOS users without an installed master password, an OS authentication dialog began to appear for viewing passwords saved in the browser, requiring the entry of system credentials. After entering the system password, access to saved passwords is granted for 5 minutes, after which the password must be entered again.
The collected telemetry showed an abnormally high level of problems with authentication using system credentials when trying to access saved passwords in the browser. In 20% of cases, users were unable to pass the confirmation and did not gain access to their saved passwords. Two main reasons have been identified as likely sources of the encountered problems:
- Users may not remember or know their system password, as they are using a session with automatic login.
- Due to insufficient clarification in the dialog, users do not understand that they need to enter their system password and try to enter the password from their Firefox Account, which is used for synchronizing settings between devices.
It was assumed that system authentication would protect credentials from prying eyes when leaving the computer unattended if a master password was not set in the browser. In reality, many users were unable to access their saved passwords. Developers temporarily disabled the new feature and plan to revise its implementation. In particular, they intend to add a clearer description of the need to enter system credentials and disable the dialog display for automatically logging-in configurations.
Source: opennet.ru
