Metamask-extension: Bug Bounty: Spontaneous Storage Loss

Created on 24 Feb 2018 · 16Comments · Source: MetaMask/metamask-extension

=========MODERATOR EDIT =========

This issue now represents a bug bounty for finding any bug where MetaMask would spontaneously wipe all of its storage, suddenly asking a user to create a new vault, as if they had never set up an account.

========= USER ORIGINAL POST: ========

When clicking on the extension icon in Chrome instead of receiving the usual login screen I see a screen saying "Encrypt your new DEN" and asking for new password.

How do I get to the login screen. I made no changes or deleted anything related to the browser or the extension lately.

Chrome Version 64.0.3282.167 (Official Build) (64-bit)
MetaMask 3.14.1

L13-storage N02-needsReproduction S1-high T00-bug has bounty

Source

FreeMako

😕1

All 16 comments

PLEASE HELP. I had the same exact error. Where is login info store? Is it a local cookie or the metamask browser itself, cause I have never had this issue before. But now I cant login to my metamask and use any DAPPS :(

indescrypto on 25 Feb 2018

To restore your old account on a new installation of MetaMask, you just click "Restore from seed phrase" during the setup process, after agreeing to terms on the fresh installation.

The process is basically described here:
https://metamask.helpscoutdocs.com/article/28-using-metamask-on-multiple-computers

As long as you saved your 12 word seed phrase when first setting up, you can always restore the accounts that you were first given, on a fresh install, or another computer, or another client entirely!

tmashuang on 26 Feb 2018

Metamask is not asking for my password, but for a NEW password. Then it gives the 12 words.... but I have a password already. Why can’t I login with my password ?

moresoon on 3 May 2018

I am having the same issue on opening Metamask on new computer. I do not want to change passwords or passphrases. When I click "import existing DEN it opens with the Wallet seed window and after I insert the seeds it still is asking to make a new password. WHY?

williecorrea on 10 Jun 2018

👍1

Exact same problem here.

When I click "import existing DEN it opens with the Wallet seed window and after I insert the seeds it still is asking to make a new password. WHY?

alkhwarizmi on 11 Jun 2018

hey @williecorrea @alkhwarizmi @moresoon as the article mentions, this is completely expected behavior. Your password is only used on your own computer to encrypt your information locally. It's never sent to a server. If you're accessing the same MetaMask account on three different machines, you could have three totally different passwords. The thing that connects them is the twelve word seed phrase, so make sure you have it backed up in a safe place.

To restore an account on a new computer, use that twelve word seed phrase. This allows the extension to re-calculate your private keys, and it will ask you to declare a new password that will just be used on that new computer for an extra layer of security.

bdresser on 12 Jun 2018

Thank you for your kind reply.

I was scared because I didn't see my imported account but, as written in the document, they are not stored in your server which, in the end, I appreciate.

The point is that I am not accessing Metamask by another computer. I started using it yesterday on my PC via chrome extension and today I just tried to use it again.

This doesn't seem to be normal. Would you be so kind as to elaborate on this, please?

Sincerely,

alkhwarizmi on 12 Jun 2018

Not sure I understand your problem @alkhwarizmi

I started using it yesterday on my PC via chrome extension and today I just tried to use it again.

If you're trying to restore from seed ("import existing DEN") then it will indeed ask you to set a new password. After this process, you'll be able to use that password to unlock MM each time you want to use it.

If you have more questions, I'd encourage you to reach out to our support team at [email protected]

bdresser on 12 Jun 2018

Oh, apologies. Maybe I wasn't clear enough.

For the record, the point is that the chrome extension didn't ask me the old password at all.

The only thing I could do was creating a new account or regenerate it via DEN. So I HAD to regenerate, but that was not my intention.

Sincerely,

alkhwarizmi on 12 Jun 2018

These behaviors resemble the browser losing all of its storage. We have seen this in the past, where we were using a storage strategy that would be wiped when a user erased their history, but we since fixed that particular issue.

This looks like a different issue where storage is being spontaneously wiped. These types of bugs can be difficult to track down, and they emphasize the importance of backing up seed phrases.

I'll reopen this for now, since we do not know if there is a case that would cause us to spontaneously lose all storage. This is easily worthy of a bug bounty, to encourage community contribution.

danfinlay on 12 Jun 2018

👍1

four reports of this issue from #4053 as well

bdresser on 12 Jun 2018

I have chrome and firefox on the same computer, but they don't work with the same password. Normal ?

Sent from Yahoo Mail for iPad

On Wednesday, June 13, 2018, 3:46 AM, bobby dresser notifications@github.com wrote:

four reports of this issue from #4053 as well

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

moresoon on 13 Jun 2018

@moresoon Yes - the password is specific to the browser. It's used to encrypt your data locally, and never leaves the browser you set it up on. You could access the same wallet from two different web browsers and use two totally different passwords.

bdresser on 13 Jun 2018

Thanks

"There is no crisis in energy, the crisis is in IMAGINATION" ~
Buckminster Fuller

The Transition is ON!!!

On Wed, Jun 13, 2018 at 1:37 PM, bobby dresser notifications@github.com
wrote:

@moresoon https://github.com/moresoon Yes - the password is specific to
the browser. It's used to encrypt your data locally, and never leaves the
browser you set it up on. You could access the same wallet from two
different web browsers and use two totally different passwords.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/MetaMask/metamask-extension/issues/3314#issuecomment-397023082,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AcDahXYqiOo8S6g7w8t3FQ1UsZpsyyFaks5t8U3pgaJpZM4SRwTZ
.

williecorrea on 13 Jun 2018

It happened to me yesterday. The last sub-account added disappeared.
I followed the tip from @bdresser (https://github.com/MetaMask/metamask-extension/issues/3330) and it came back. I guess one has to remember the exact name of the sub-account to do a restore like this.