If you have no master password set, then the login passwords are always available. If you do have a master password set, then opening the Saved Logins dialog will prompt you for the master password. Without the correct master password, the list of logins will be empty and thus there is no password to copy.
The bug only occurs in this specific condition:
- A master password is set.
- You have unlocked your logins by entering the master password once this browsing session.
To be clear: if you have a master password set, and have not unlocked your logins this session, your passwords will still be protected and not be available through this bug.
Passwords are stored encrypted on disk, protected by a key derived from the master password. If you start Firefox for the first time, it will usually prompt you only once for your master password when it encounters a login form, or when you open the Saved Logins section. If you dismiss this request, the logins will not be available. If you however enter the password, the decrypted passwords will be available until you quit Firefox.
Normally, when you use the Show Passwords button, or if you right-click a login and chose Copy Password, it will prompt you for the password once again. Due to the bug, the password confirmation prompt was displayed, but the password was already being copied in the background.
The impact is very low in my opinion. Someone with physical access to your unlocked session can already obtain the password in other ways:
- Visit the website, for example, https://stackoverflow.com/users/login
- Observe that the login is filled in.
- Open Developer Tools (F12), go to Console.
- Observe the password.
Alternatively, you could go to the Network tab in Developer Tools. Press Login and observe the password being recorded. There are plenty of methods to obtain the logins if it is already filled in.
As for the commit that references the bug, the code defect was that an asynchronous call (
masterPasswordLogin()) was not waited for. That is why the code to copy the password is already executed before the login prompt was confirmed. The fix is to wait for the prompt to be completed.
The original security advisory from Mozilla only stated that passwords can be copied without entry of the master password. Since then, this security advisory has been updated with the above clarification, and now reads:
When a master password is set, it is required to be entered again
before stored passwords can be accessed in the 'Saved Logins' dialog.
It was found that locally stored passwords can be copied to the
clipboard thorough the 'copy password' context menu item without
re-entering the master password if the master password had been
previously entered in the same session, allowing for potential theft
of stored passwords.