I'm running FF 77.01 on Red Hat Enterprise 7.8. I have a master password set but I moved all of my credentials to an external password manager last year so FF's password db is actually empty[1]. I also do not have 'sync' enabled. As such, FF doesn't normally ask for my password.
Very occasionally, I'll unlock my screen to find that FF is requesting me to enter the master password. For a while I was concerned that perhaps one of my FF extensions was trying to be sneaky and was trying access the (nonexistent) passwords when it detected the machine had been idle for a while. But I think something else is happening instead.
Yesterday I stumbled upon a website that causes FF to request the master password repeatedly, even in safe mode. I'm not an HTML/Javascript/CSS expert so I figured I'd ask here here: what is it about this site that causes FF to think that it needs my master password?
URL: https://ww3.rainbird.com/homeowner/support/video-RotorArcAdjust.htm
Does FF use the master password to encrypt site cookies or something? And if that's true, what's unique about this site? Why doesn't it happen for any site that wants to store persistent data?
Someone on another forum suggested that I enable debug logging for the FF password manager to see if anything interesting appears. I did so. One thing that stood out were dozens of "STATE_IS_BROKEN without a known reason" messages. However, none of the log messages seemed to correlate very well with the appearance of the password dialogs.
For example, in safe mode and with all cookies and history cleared. Upon entering the URL I was immediately shown the password dialog before anything was rendered. I then waited about 20 seconds before canceling the dialog at which the page began to render and another password dialog opened.
- Code: Select all
09:17:40.337 GET https://ww3.rainbird.com/homeowner/support/video-RotorArcAdjust.htm [HTTP/1.1 200 OK 19201ms]
< at this point, I let FF sit idle with the password dialog open for ~20 sec >
09:17:59.539 STATE_IS_BROKEN without a known reason. Full state was: 1 ThreadSafeDevToolsUtils.js:82:13
09:17:59.636 This site uses a deprecated version of TLS that will be disabled in March 2020. Please upgrade to TLS 1.2 or 1.3.
...
...
In total, the password dialog was shown 6 times while rendering this page. Later, it appeared once more after FF main window regained focus.
Any ideas what's going on?
[1] I realize I could just disable the master password since I have nothing to protect but that would probably hide this behavior. I'm simply curious about what's going on.
