4

How can I determine the extension that's causing this sketchy pop-up I'm seeing in Firefox? I've determined:

  1. The pop-up appears reliably immediately after Firefox starts with this profile.
  2. It still appears at startup even if I disable all my extensions using the sliders about:addons.
  3. It does not appear when I start Firefox in safe-mode.
  4. It does not appear if I switch to a different profile.

I can reset my profile to get rid of whatever is causing this pop-up, but I'd like to identify the source so I can try to report it.

I'm running Firefox 73.0.1 (64-bit) on Mac OS High Sierra 10.13.6 (17G11023).


Background:

I'm getting this sketchy password prompt twice each time I start FireFox on my Mac:

Password Required Please enter the master password for the My Computer (PIN Required).

In that view, it's locked to the Firefox window, however, sometimes it manages to appear as a floating window that seems unconnected to Firefox (this seems to happen more when I sleep my computer):

Password Required Please enter the master password for the My Computer (PIN Required).


Important Note: I am NOT seeing a Firefox master password prompt. Here is a genuine master password prompt from Firefox, which is obviously different than what I've posted above:

Password Required Please enter your master password.

1
  • I have disabled all my add-ons and am still seeing this dialog. If I fail to respond to it, I get another dialog not long after. If I step away from my computer for a while, I come back to dozens (sometimes hundreds) of the same dialog. This is tempting me to move off Firefox... I am eager for a solution here, too! – fbrereto Apr 10 '20 at 16:45
3

TL;DR

This is a very long answer, as I have documented all my research below. If you don't care about that, what I found was that this is a legitimate Firefox pop-up and what it is asking for is the password to open a certificate chain called My Computer (PIN Required). This appears to be installed by Symantec via the Symantec PKI Client.

If you have this problem and know that you don't need the Symantec Security Module in Firefox, just do the following:

  1. Select PreferencesPrivacy & SecurityCertificatesSecurity Devices
  2. The "Device Manager" window will open. In the Security Modules and Devices list on the lef-hand, select Symantec Security Module and click Unload on the right.

If you get this and are also confused, I've opened the following feature request in the Firefox Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1651688. If you have substantial information to add, you can add it there (but please refrain from "me too" comments!)

Full journey to discover the source of the popup

First off, I don't know the answer to the core question, which is "how can I determine what is responsible for a popup in Firefox". This, in itself, is a problem which Mozilla should address.

However, I have found clues that lead me to believe that the popup is actually from Firefox itself.

First off, my setup: I use Firefox on multiple devices, some Windows, some Mac. I have Firefox Sync set up between them. I don't know if this is important, but it's a data point. I only ever see this on my Mac.

Second, I've tried nuking my profile and the problem magically reappears after a while. I initially thought that this was caused by Firefox Sync reinstalling the faulty/malicious extension that causes the popup. I now suspect this isn't the case.

I can consistently recreate the error by either:

  1. Restarting Firefox, after a few seconds, this pops up as a modal in one the Firefox windows (note that it isn't modal in other windows in case of a session restore with multiple windows).

  2. Changing network state. Either of the following will provoke the popup in a running Firefox:

    a. Disabling Wifi

    b. Re-enabling wifi

    c. Connecting to a VPN

From the above, it is my suspicion that any network or application state change will prompt this.

After attempting to manually uninstall extensions and still consistently getting the popup, and searching the the text in all of my profile, my gaze fell on Firefox itself.

Searching the Firefox application file for variations of the prompt text, gives the following:

$ find /Applications/Firefox.app/ -type f -exec grep -H "Please enter the master password for the" {} \;
Binary file /Applications/Firefox.app//Contents/Resources/omni.ja matches

This is a ZIP file (but luckily without compression, so the texts are visible). Unzipping this to a temporary location (called ~/omni.ja here), uncovers this:

$ find ~/omni.ja -type f -exec grep -H "Please enter the master password for the" {} \;
~/omni.ja/chrome/en-CA/locale/en-CA/pipnss/pipnss.properties:CertPassPrompt=Please enter the master password for the %S.

Hoping that the use of this resource was in the same file, I tried this:

$ find ~/omni.ja -type f -exec grep -H "CertPassPrompt" {} \;
~/omni.ja/chrome/en-CA/locale/en-CA/pipnss/pipnss.properties:CertPassPrompt=Please enter the master password for the %S.
~/omni.ja/chrome/en-CA/locale/en-CA/pipnss/pipnss.properties:CertPassPromptDefault=Please enter your master password.

This is very interesting to me. It tells me that it is similar code that uses the Firefox master password and this odd prompt. In the latter case, the text "My Computer (PIN Required)" would be passed in.

Searching for My Computer in the Firefox bundle and my local profiles yielded nothing, so this string is from some external source.

Searching the Web for "My Computer (PIN Required)" did uncover the following: https://www.hybrid-analysis.com/sample/57db1053fe642fbdf93f13537b9f38290e4bc28b310b607124cca43d614321fc?environmentId=120

"My Computer (PIN Required)" in PKIClientAgent.exe

So it looks like it is related to an attempt to access a certificate keystore with a name that is specific to the Symantec PKI Client.

Looking into my setup on my Mac, it turns out that my employer have installed a PKI Client executable that appears to provide a virtual device called "My Computer (PIN Required)". I believe the certificate chains in this device is used for authentication on the company Wi-Fi.

Some more digging around in the Mozilla source, I found that this is used in nsNSSCallbacks.cpp. This seems to be related to "PK11", again pointing to this being certificate-related. Some further digging in the related source code documentation for the pkcs11 module, which references "PKCS#11 Modules" in the Firefox settings. Note that the Mozilla doc is for Windows. On Mac, the route is ☰ → Preferences → Privacy & Security → Certificates → Security Devices. I had this:

Security Modules including the Symantec Security Module

As mentioned, I believe the Symantec module is used only for my company's Wi-fi, so I selected the Symantec Security Module group in this dialog and clicked Unload.

This has so far eliminated the pop-up.

3
  • 1
    Fantastic answer! My employer also uses Symantec PKI infrastructure, but I've had the Symantec Authentication Client Extension disabled since I switched profiles to avoid this error, and I no longer have the Symantec Security Module. Thanks! – Kaypro II Jul 9 '20 at 17:08
  • Thanks. This is really a perfect storm of employer-managed software that we (well, at least I) don't know much about, a browser that relies on 3rd-parties to properly name security devices, and a 3rd-party security device provider that decided to not do so... – dovetalk Jul 10 '20 at 12:12
  • I actually raised a bug for this bugzilla.mozilla.org/show_bug.cgi?id=1686189 after experiencing it myself. I think it started happening after updating certs... Would love to know what it actually helps with – SystemsInCode Jan 21 at 10:30
1

The only way I was able to get this dialog to go away was to delete Firefox.app, my ~/Library/Application Support/Firefox folder, and reinstall Firefox afresh. I am using Firefox's built-in profile sync capabilities, and my bookmarks, etc., appear to all have returned OK. The dialog appears to be gone. Hope that helps!

1
  • 1
    As per my diary-like answer highlights, I don't think you need to nuke the entire profile. You can simply unload the offending security module in Preferences (see my answer for more details that you'd ever want) – dovetalk Jul 9 '20 at 14:35
-2

Many browsers will ask for the password of the user account to before revealing any stored website logins. Firefox has a setting to set your own custom "master password". Firefox doesn't do this by default, but ensure the "Use a master password" setting (see image here) is unchecked in your Preferences/Options. It is found under Privacy & Security in the Logins and Passwords section.

More information about this setting can be found at this Mozilla support article.

6
  • I am not seeing the Firefox master password prompt, but rather a prompt from some kind of malware that appears to be imitating it. I had the "User a master password" setting disabled, and I also verified that the real master password prompt uses different wording. – Kaypro II Feb 27 '20 at 19:44
  • Here are the hints that the prompt I'm seeing is not genuine: 1. grammar mistakes "...password for the My Computer...", 2. referencing the Windows-concept of "My Computer" on a Mac, 3. and the general awkwardness (such as the "PIN Required" part). – Kaypro II Feb 27 '20 at 19:47
  • Also, your answer does not answer my question, which was how to identify the source of the fake password prompt. I've already outlined how to disable the prompt in my question comment: "I can reset my profile to get rid of whatever is causing this pop-up..." – Kaypro II Feb 27 '20 at 19:54
  • @DrMoishePippik The original poster has indicated that they are using Mac OS. Because of this, they are not able to use that software from Nirsoft as it is a Windows-only executable. – iskyfire Feb 27 '20 at 20:28
  • @KayproII I wanted to provide information about that setting as a starting point. I know that you reset your profile, and so the setting should the default (off), but I wanted to bring it up because you had not mentioned the setting in your original question. Our next steps would to be to 1) See if the popup still appears if you are not connected to the internet, and if it doesn't appear when you open firefox while offline you may be able to track it using a program that monitors all traffic in and out of your computer. – iskyfire Feb 27 '20 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.