clearing saved passwords possible without master password

Firefox 1.5 no longer has a "Clear All" button.

If someone has physical access to a computer, there will always be a way for them to remove traces of their actions. It's just a question about how much you want to pretend that they can't, and how noticeable the deletion will be after the fact.

See bug 266945 for a Password Manager specific discussion.

I do not feel that the "tools - Options" section should be available to everyone who uses a computer, just those who know the master password.

This happen is Linux as well, here is the Ubuntu bug related to this.

https://bugs.launchpad.net/firefox/+bug/382107

*** Bug 498748 has been marked as a duplicate of this bug. ***

Confirming, for investigation. This might be a privacy boost of sorts, but consider the fact that history can still be deleted (as well as cookies and passwords) through other mechanisms, making this kind of futile.

I think this is WONTFIX, but not because I'm not sympathetic, just because I think a) we've mitigated the problem somewhat, and b) doing more than that wouldn't really help things.

As to the mitigation - the new Clear Recent History dialog in Firefox 3.5 makes it harder for this kind of impulsive clearing to have the really exciting consequences Alan describes in comment 0. We don't offer to clear bookmarks or saved passwords at all any more, so the real loss here would be awesomebar contents, cookies, and form autocomplete. But the fact that we provide a time span feature (with a 1-hour default) also makes it much less likely that the daughter in question here would wipe out everything. So I assert that the bug, as reported, would not have occurred with our new dialog the way it did with the old one.

Further, making CRH ask for a master password would ignore the multitude of other ways that exist within the browser and without to damage or delete profile and history data. The Master Password is a combination lock to protect saved passwords from prying eyes, but it is not a "login to the browser" feature in the general sense and even if it were, it would still only prevent stealing of private information, not deletion. A local user logged into your machine can delete things at any point - and a sufficiently motivated or mortified teenager might be among the most adept at doing so.

Because I think things are substantially better now (she likely would have just used Private Browsing mode, if she was poking around in the tools menu) and because the perceived incremental win here isn't really a win, and does not justify the code cost, I'm marking this WONTFIX. Thanks for pinging it, Natch.