Toolkit:Password Manager: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(Removing obsolete content)
(→‎Architecture: Link to Glossary)
 
(30 intermediate revisions by the same user not shown)
Line 1: Line 1:
The Toolkit password manager is responsible for remembering usernames and passwords on sites and allowing the user to autofill or autocomplete it upon returning to the website.
[[File:Password Manager icon.png|right|Password manager key icon]]
The Toolkit password manager is responsible for remembering usernames and passwords (aka. logins) on sites and allowing the user to autofill or autocomplete it upon returning to the website.


=== Mac OS X Integration ===
* Bug tracking:
** Components:
*** [https://bugzilla.mozilla.org/buglist.cgi?component=about:logins&product=Firefox&bug_status=__open__ Firefox::about:logins] ([https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&component=about:logins File a bug]) for [[Toolkit:Password_Manager/about:logins|about:logins]]
*** [https://bugzilla.mozilla.org/buglist.cgi?component=Password%20Manager&product=Toolkit&bug_status=__open__ Toolkit::Password Manager] ([https://bugzilla.mozilla.org/enter_bug.cgi?product=Toolkit&component=Password%20Manager File a bug])
*** [https://bugzilla.mozilla.org/buglist.cgi?component=Password%20Manager:%20Site%20Compatibility&product=Toolkit&bug_status=__open__ Toolkit::Password Manager: Site Compatibility] ([https://bugzilla.mozilla.org/enter_bug.cgi?product=Toolkit&component=Password%20Manager:%20Site%20Compatibility File a bug])
** [https://docs.google.com/spreadsheets/d/1VQuZoC6-i9wgtHAqk08IHUj7zXy1cvKjchNY8WExVXE/edit#gid=0 Current Backlog] | [https://bugzilla.mozilla.org/buglist.cgi?quicksearch=pri%3AP1%20OR%20pri%3AP2%20prod%3DToolkit%20comp%3APassword%20&list_id=14542888 P1/P2 bugs] | [https://telemetry.mozilla.org/probe-dictionary/?search=pwmgr Telemetry probes] | [https://mnoorenberghe.github.io/password-bugs/ meta bugs] | [http://mzl.la/1Enx1bl Unassigned Mentored Bugs]
* Preferences: <code>signon.*</code>
* Code:
** [https://searchfox.org/mozilla-central/source/browser/components/aboutlogins/ browser/components/aboutlogins/] for [[Toolkit:Password_Manager/about:logins|about:logins]]
** [https://searchfox.org/mozilla-central/source/toolkit/components/passwordmgr/ toolkit/components/passwordmgr/]
* Mailing List: [https://mail.mozilla.org/listinfo/passwords-dev passwords-dev]
* Chat: [https://matrix.to/#/!rULHhrUvckJYfNKouF:mozilla.org?via=mozilla.org&via=t2bot.io #lockwise-desktop]
* QA documentation:
** [https://docs.google.com/document/d/1l2-I4YsufNEv7kCiHQDvs3FCXM1A11GKstLnlJbX_gs/edit General Password Manager]
** [https://docs.google.com/document/d/1NTqXN2OgqBALMlPZhKJpz6xML434Zw9Riapt-VqyB5I/edit?usp=sharing Login CSV Export]


(See also [https://bugzilla.mozilla.org/show_bug.cgi?id=106400 bug 106400], [https://bugzilla.mozilla.org/show_bug.cgi?id=496660 bug 496660].)
== Priority Bugs ==


Mac OS X provides an application called Keychain Services which manages passwords and certificates for all applications including web browsers. It provides default encryption of the passwords and certificates using the user's login password, locks and unlocks the chain per application etc. Basically everything we've had to re-implement for our password manager (including Master Password etc).
(Not including [[Toolkit:Password_Manager/about:logins|about:logins]] bugs)


We should transition to using Keychain Sevices as the "out of the box" back end for storing passwords and certificates. This will allow users transitioning from Safari and Camino to bring across their site passwords in addition to their Bookmarks, Preferences and other data for the optimal user experience.
=== P1 ===
<!--
var str = "";
for (let [k,v] of new URLSearchParams(window.location.search)) {
  str += `"${k}": "${v}",\n`;
}
-->
<bugzilla>
{
"priority": "P1",
"v4": "[passwords:",
"f1": "keywords",
"o3": "substring",
"list_id": "15004848",
"v3": "Password Manager",
"o1": "nowords",
"j2": "OR",
"resolution": "---",
"f4": "status_whiteboard",
"f3": "component",
"f2": "OP",
"o4": "substring",
"f5": "CP",
"v1": "meta",


We should retain the existing back end in code for Windows and Linux, and for Mac OS X 1.0 users who have established password and certificates collections. We need some heuristic for detecting whether or not Firefox is the default browser, has an established password collection etc so we can determine which back end to use.
  "include_fields": "id, summary, severity, assigned_to, keywords, whiteboard",
  "order": "assigned_to"
}
</bugzilla>


We might also offer a hidden pref to let users toggle between the two in case the heuristic breaks down.
=== P2 ===


The integration is very simple - where we retrieve password and certificate data from our password and certificate store now, we alternate on some preference value ("use keychain") - if not, use the old way, if so, call SecKeychainFindInternetPassword to get the value.
<bugzilla>
{
"priority": "P2",
"v4": "[passwords:",
"f1": "keywords",
"o3": "substring",
"list_id": "15004848",
"v3": "Password Manager",
"o1": "nowords",
"j2": "OR",
"resolution": "---",
"f4": "status_whiteboard",
"f3": "component",
"f2": "OP",
"o4": "substring",
"f5": "CP",
"v1": "meta",


By keeping the integration at this very low level we can minimize the impact of the changes and retain the functionality that Firefox users expect - dropdown showing choice of options (multiple options can be stored in our signons file - we just don't store the passwords and certificates there) - we can even add metadata (username/password field name attribute values) when we discover them to the signon file, which at that point just becomes a metadata storage point.
  "include_fields": "id, summary, severity, assigned_to, keywords, whiteboard",
  "order": "assigned_to"
}
</bugzilla>


==== Dependencies ====
==== Site Compatibility ====


Two dependencies for Keychain Services integration on Mac OS X:
<bugzilla>
{
  "f1": "component",
  "o1": "equals",
  "v1": "Password Manager: Site Compatibility",
  "f3": "keywords",
  "o3": "nowords",
  "v3": "meta",
  "priority": "P2",
  "resolution": "---",
  "include_fields": "id, summary, priority, severity, assigned_to, keywords, whiteboard",
  "order": "assigned_to"
}
</bugzilla>


* the ability to open Keychain Services from Preferences (add a method or constant to nsI*ShellService)
== Architecture ==
* the ability to detect if default browser (implemented on Windows but not MacOS X) (this may prove challenging in addition since nsIShellService is a browser API, not a toolkit one where password manager lives. Maybe it should move, or become more generic)
* [[Toolkit:Password Manager/Glossary|Glossary of terms]]
* [https://docs.google.com/document/d/1tsRQlGG5fatPo53paR1ZYL8_fox86IUEHuwhonMqaHY/edit Rough intro document]


== Existing Extensions in 2009 ==
[[File:PasswordManagerRelationships.svg|1000px]]


The following password-management extensions are on addons.mozilla.org, and give some indication of what kind of features people find useful.
[[File:PasswordManagerAutocomplete.svg|1000px]]
 
* [https://addons.mozilla.org/en-US/firefox/addon/13509 Keychain Services Integration]
* [https://addons.mozilla.org/en-US/firefox/addon/3863 iMacros for Firefox] Stores master password in Firefox password manager
* [https://addons.mozilla.org/firefox/1033/ PwdHash] 226
* [https://addons.mozilla.org/firefox/469/ PasswordMaker] 525
* [https://addons.mozilla.org/firefox/750/ AI Roboform Toolbar] 3615
* [https://addons.mozilla.org/firefox/3282/ Password Hasher] 1708
* [https://addons.mozilla.org/firefox/3825/ Annoyance Remover] 286
* [https://addons.mozilla.org/firefox/1890/ LoginManager] 568
* [https://addons.mozilla.org/firefox/4429/ Secure Login] 3567
* [https://addons.mozilla.org/firefox/135/ SecurePassword Generator] 739
* [https://addons.mozilla.org/firefox/3208/ Fire Encrypter] 1166 (mainly encryption, but has a "secure password generator")
* [https://addons.mozilla.org/firefox/2848/ Password Exporter] 88
* [https://addons.mozilla.org/firefox/3476/ SignupShield] 89
* [https://addons.mozilla.org/firefox/1275/ Master Password Timeout] 586
* [https://addons.mozilla.org/firefox/2186/ WiKID] 6 (2-factor auth)
* [https://addons.mozilla.org/firefox/2667/ 1passwd] 35
* [https://addons.mozilla.org/firefox/1222/ Passguard Login Manager] 53
* [https://addons.mozilla.org/firefox/670/ Password Composer] 6
* [https://addons.mozilla.org/fr/firefox/addon/4133 Password Finder] ?


== See Also ==
== See Also ==
{{subpagelist}}
{{subpagelist}}
[[Firefox:Password_Manager:UI]]
[[Firefox:Password_Manager:UI]]
[https://bugzilla.mozilla.org/buglist.cgi?component=Password%20Manager&product=Toolkit&bug_status=__open__ Bug List]
[https://bugzilla.mozilla.org/enter_bug.cgi?product=Toolkit&component=Password%20Manager File a bug]

Latest revision as of 20:10, 18 June 2020

Password manager key icon

The Toolkit password manager is responsible for remembering usernames and passwords (aka. logins) on sites and allowing the user to autofill or autocomplete it upon returning to the website.

Priority Bugs

(Not including about:logins bugs)

P1

Bugzilla query error

Array ( [type] => error [message] => http-bad-status [params] => Array ( [0] => 429 [1] => Unknown Error ) ) 1


P2

Bugzilla query error

Array ( [type] => error [message] => http-bad-status [params] => Array ( [0] => 429 [1] => Unknown Error ) ) 1


Site Compatibility

Bugzilla query error

Array ( [type] => error [message] => http-bad-status [params] => Array ( [0] => 429 [1] => Unknown Error ) ) 1


Architecture

PasswordManagerRelationships.svg

PasswordManagerAutocomplete.svg

See Also

Firefox:Password_Manager:UI

Retrieved from "https://wiki.mozilla.org/index.php?title=Toolkit:Password_Manager&oldid=1228264"