Browser-laptop: Trezor passphrase being saved to password list and offered by auto fill without permission.

Created on 9 Jan 2018 · 12Comments · Source: brave/browser-laptop

Description

Just upgraded to the new version. Turned on strict site isolation. Plug Trezor in and now my passphrase is available via autofill. The Trezor had been added to the saved passwords list. I didn't ok that. I deleted the pass phrase and the Trezor from the saved password list, entered it again into the Trezor and brave saved the passphrase again without asking. I've since shutdown auto fill and password management via brave.
This behavior started after the update. i'd used the Trezor multiple times today without this issue until the update was made.

Steps to Reproduce

1.
2.
3.

Actual result:

Expected result:

Reproduces how often:

Brave Version

about:brave info:

Reproducible on current live release:

Additional Information

Qchecked-Linux Qchecked-Win64 Qchecked-macOS Qtest-plan-specified featurautofill featurpassword-manager release-noteinclude security

Source

higzac

All 12 comments

cc: @darkdh @diracdeltas

srirambv on 9 Jan 2018

I'm referring to the passphrase for a particular wallet account not the mnemonic.
If you enable passphrase protection on the trezor you can create separate accounts that are accessed by the specific passphrase.

higzac on 9 Jan 2018

probably related to the other password autofill changes that were in the last release, not strict site isolation.

diracdeltas on 9 Jan 2018

@higzac would you mind turning off strict site isolation and try again? It helps us narrow down that it is another password manager changes in the same release.

darkdh on 9 Jan 2018

There are 2 issues:

Built-in password manager couldn't actually be turned off (https://github.com/brave/browser-laptop/issues/10566)
chromium password manager will save the following form as bravetest/bravetest

These two issues have already been there since we migrate to chromium password manager and https://github.com/brave/browser-laptop/issues/12489#issuecomment-355350464 exaggerates it upon page load because we will popup the USERNAME which about to fill to users
screen shot 2018-01-09 at 11 40 37 am

However, I couldn't reproduce the automatically save because it will ask every time
screen shot 2018-01-09 at 11 36 40 am

@bsclifton we might need https://github.com/brave/browser-laptop/issues/10566 in this milestone

darkdh on 9 Jan 2018

Sorry for the delay in getting back to you.
Had a chance to play around to get a better idea of what happened.
I can repeat the problem with (strict site isolation) Enabled or disabeld

Looking at what I can repeat this is what is happening

Connect trezor and log into account.
Option to save password presents itself.
I must have clicked ok to this accidentally
Log out of trezor. Then log back in.
I'm now offered the (use password for option) where the user is my password.
Log out of the trezor
Open preferences in brave and go to password settings.
Delete the entry for the trezor.
Connect trezor.
I'm offered the user name password option again where the user name is the password even though I just deleted it from password settings in brave..
Enter my password again log in.
New entry with my username password added back to password settings in brave.
There is no dialogue to ok adding it, its just added back.
This happens if you don't close brave down after deleting the user name password.
If you stay in the same session you don't get a promt from brave when it adds the password back to its list.
If i close brave after deleting the password then restart all the correct prompts happen to warn me brave is saving the password